{"grype_matches":[{"artifact":{"id":"311a0db9d1ce5e8a","cpes":["cpe:2.3:a:brotli:brotli:1.0.6-4.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:brotli:1.0.6-4.el8_10:*:*:*:*:*:*:*"],"name":"brotli","purl":"pkg:rpm/redhat/brotli@1.0.6-4.el8_10?arch=x86_64&distro=rhel-8.10&upstream=brotli-1.0.6-4.el8_10.src.rpm","type":"rpm","version":"1.0.6-4.el8_10","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.0.6-5.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-111497","versionConstraint":"< 0:1.0.6-5.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"brotli","version":"0:1.0.6-4.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-111497","fix":{"state":"fixed","versions":["0:1.0.6-5.el8_10"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"0:1.0.6-5.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-11-07","epss":0.82641,"percentile":0.99669}],"risk":81.9,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:90501","link":"https://access.redhat.com/errata/RHSA-2026:90501"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-111497","description":"A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or potentially arbitrary code execution.","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-111497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-11-07","epss":0.82641,"percentile":0.99669}],"urls":["https://github.com/andybalholm/brotli/releases/tag/v1.2.7","https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","http://www.openwall.com/lists/oss-security/2026/10/23/25","http://www.openwall.com/lists/oss-security/2026/10/24/6","http://www.openwall.com/lists/oss-security/2026/10/26/12","http://www.openwall.com/lists/oss-security/2026/10/26/13","http://www.openwall.com/lists/oss-security/2026/10/26/16","http://www.openwall.com/lists/oss-security/2026/11/03/2","https://broccoli2shell.com","https://github.com/advisories/GHSA-9v8h-qqgm-4m35","https://github.com/dotnet/announcements/issues/494","https://github.com/google/brotli/releases/tag/v1.0.10","https://github.com/google/brotli/releases/tag/v1.1.1","https://github.com/google/brotli/releases/tag/v1.2.1","https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html","https://patchtheplanet.org/brotli","https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","https://cert-portal.siemens.com/productcert/html/ssa-045512.html","https://cert-portal.siemens.com/productcert/html/ssa-443410.html","https://cert-portal.siemens.com/productcert/html/ssa-898633.html","https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-2650","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-2650","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-11-07","epss":0.75358,"percentile":0.99518}],"risk":43.33085,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-2650","description":"A flaw was found in OpenSSL resulting in a possible denial of service while translating ASN.1 object identifiers. Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience long delays when processing messages, which may lead to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-2650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-11-07","epss":0.75358,"percentile":0.99518}],"urls":["http://www.openwall.com/lists/oss-security/2023/05/30/1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230703-0001/","https://security.netapp.com/advisory/ntap-20231027-0009/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230530.txt","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-699386.html","https://cert-portal.siemens.com/productcert/html/ssa-943925.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-2650","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-2650","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-11-07","epss":0.75358,"percentile":0.99518}],"risk":43.33085,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-2650","description":"A flaw was found in OpenSSL resulting in a possible denial of service while translating ASN.1 object identifiers. Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience long delays when processing messages, which may lead to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-2650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-11-07","epss":0.75358,"percentile":0.99518}],"urls":["http://www.openwall.com/lists/oss-security/2023/05/30/1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230703-0001/","https://security.netapp.com/advisory/ntap-20231027-0009/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230530.txt","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-699386.html","https://cert-portal.siemens.com/productcert/html/ssa-943925.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-07","epss":0.59302,"percentile":0.99124}],"risk":19.866169999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-2511","description":"A flaw was found in OpenSSL. A malicious client can trigger an uncontrolled memory consumption, resulting in a Denial of Service. This issue occurs due to OpenSSL's TLSv1.3 session cache going into an incorrect state, leading to it failing to flush properly as it fills. OpenSSL must be configured with the non-default SSL_OP_NO_TICKET option enabled to be vulnerable. This issue only affects TLSv1.3 servers, while TLS clients are not affected."},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-07","epss":0.59302,"percentile":0.99124}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-07","epss":0.59302,"percentile":0.99124}],"risk":19.866169999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-2511","description":"A flaw was found in OpenSSL. A malicious client can trigger an uncontrolled memory consumption, resulting in a Denial of Service. This issue occurs due to OpenSSL's TLSv1.3 session cache going into an incorrect state, leading to it failing to flush properly as it fills. OpenSSL must be configured with the non-default SSL_OP_NO_TICKET option enabled to be vulnerable. This issue only affects TLSv1.3 servers, while TLS clients are not affected."},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-07","epss":0.59302,"percentile":0.99124}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-07","epss":0.20217,"percentile":0.97481}],"risk":8.390055,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7264","description":"A flaw was found in libcurl, where libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the *time fraction*, leading to a `strlen()` performed on a pointer to a heap buffer area that is not purposely NULL terminated."},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-07","epss":0.20217,"percentile":0.97481}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-07","epss":0.20217,"percentile":0.97481}],"risk":8.390055,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7264","description":"A flaw was found in libcurl, where libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the *time fraction*, leading to a `strlen()` performed on a pointer to a heap buffer area that is not purposely NULL terminated."},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-07","epss":0.20217,"percentile":0.97481}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"bcecf49dfefd132c","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.26.0-21.el8_10?arch=x86_64&distro=rhel-8.10&upstream=sqlite-3.26.0-21.el8_10.src.rpm","type":"rpm","version":"3.26.0-21.el8_10","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.26.0-21.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9937","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"sqlite","version":"3.26.0-21.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-9937","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9937","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9937","date":"2026-11-07","epss":0.06136,"percentile":0.93495}],"risk":2.54644,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-9937","description":"A vulnerability was found in SQLite due to a NULL pointer dereference in the fts5ChunkIterate function within sqlite3.c, where an attacker could exploit this flaw by creating a specially crafted table, causing the application to crash and resulting in a denial of service condition."},"relatedVulnerabilities":[{"id":"CVE-2019-9937","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9937","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9937","date":"2026-11-07","epss":0.06136,"percentile":0.93495}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html","http://www.securityfocus.com/bid/107562","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/","https://security.gentoo.org/glsa/201908-09","https://security.netapp.com/advisory/ntap-20190416-0005/","https://sqlite.org/src/info/45c73deb440496e8","https://usn.ubuntu.com/4019-1/","https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114383.html","https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114393.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9937","description":"In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c."}]},{"artifact":{"id":"55281a0c21c596b7","cpes":["cpe:2.3:a:redhat:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=rhel-8.10&epoch=2&upstream=tar-1.30-11.el8_10.src.rpm","type":"rpm","version":"2:1.30-11.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2005-2541","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"tar","version":"2:1.30-11.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2005-2541","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-11-07","epss":0.03992,"percentile":0.90576}],"risk":2.3951999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2005-2541","description":"A flaw was found in tar utility that can allow the root user to extract files with preserved setuid and setgid permissions without any warning. This behavior can lead to the creation of malicious setuid executables owned by root from a crafted tar file, posing significant security risks."},"relatedVulnerabilities":[{"id":"CVE-2005-2541","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-11-07","epss":0.03992,"percentile":0.90576}],"urls":["http://marc.info/?l=bugtraq&m=112327628230258&w=2","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-9674","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.2,"impactScore":3.6,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9674","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9674","date":"2026-11-07","epss":0.05636,"percentile":0.93001}],"risk":2.0289599999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-9674","description":"A ZIP bomb attack was found in the Python zipfile module. A remote attacker could abuse this flaw by providing a specially crafted ZIP file that, when decompressed by zipfile, would exhaust system resources resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2019-9674","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9674","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9674","date":"2026-11-07","epss":0.05636,"percentile":0.93001}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html","https://bugs.python.org/issue36260","https://bugs.python.org/issue36462","https://github.com/python/cpython/blob/master/Lib/zipfile.py","https://python-security.readthedocs.io/security.html#archives-and-zip-bomb","https://security.netapp.com/advisory/ntap-20200221-0003/","https://usn.ubuntu.com/4428-1/","https://www.python.org/news/security/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9674","description":"Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-9674","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.2,"impactScore":3.6,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9674","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9674","date":"2026-11-07","epss":0.05636,"percentile":0.93001}],"risk":2.0289599999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-9674","description":"A ZIP bomb attack was found in the Python zipfile module. A remote attacker could abuse this flaw by providing a specially crafted ZIP file that, when decompressed by zipfile, would exhaust system resources resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2019-9674","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9674","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9674","date":"2026-11-07","epss":0.05636,"percentile":0.93001}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html","https://bugs.python.org/issue36260","https://bugs.python.org/issue36462","https://github.com/python/cpython/blob/master/Lib/zipfile.py","https://python-security.readthedocs.io/security.html#archives-and-zip-bomb","https://security.netapp.com/advisory/ntap-20200221-0003/","https://usn.ubuntu.com/4428-1/","https://www.python.org/news/security/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9674","description":"Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb."}]},{"artifact":{"id":"bcecf49dfefd132c","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.26.0-21.el8_10?arch=x86_64&distro=rhel-8.10&upstream=sqlite-3.26.0-21.el8_10.src.rpm","type":"rpm","version":"3.26.0-21.el8_10","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.26.0-21.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19244","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"sqlite","version":"3.26.0-21.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-19244","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-19244","date":"2026-11-07","epss":0.03593,"percentile":0.8951}],"risk":1.8863249999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-19244","description":"A flaw was found in the way SQLite handled certain types of SQL queries using DISTINCT, OVER and ORDER BY clauses. A remote attacker could exploit this flaw by providing a malicious SQL query that, when processed by an application linked to SQLite, would crash the application causing a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2019-19244","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-19244","date":"2026-11-07","epss":0.03593,"percentile":0.8951}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/sqlite/sqlite/commit/e59c562b3f6894f84c715772c4b116d7b5c01348","https://usn.ubuntu.com/4205-1/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://cert-portal.siemens.com/productcert/html/ssa-389290.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19244","description":"sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-0464","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-0464","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0464","date":"2026-11-07","epss":0.03985,"percentile":0.9056}],"risk":1.7733250000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-0464","description":"A security vulnerability has been identified in all supported OpenSSL versions related to verifying X.509 certificate chains that include policy constraints. This flaw allows attackers to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial of service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or calling the X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[{"id":"CVE-2023-0464","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0464","date":"2026-11-07","epss":0.03985,"percentile":0.9056}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.couchbase.com/alerts/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230322.txt","https://security.netapp.com/advisory/ntap-20230406-0006/","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-077170.html","https://cert-portal.siemens.com/productcert/html/ssa-337522.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-625862.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-879734.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464","description":"A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints.  Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-0464","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-0464","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0464","date":"2026-11-07","epss":0.03985,"percentile":0.9056}],"risk":1.7733250000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-0464","description":"A security vulnerability has been identified in all supported OpenSSL versions related to verifying X.509 certificate chains that include policy constraints. This flaw allows attackers to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial of service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or calling the X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[{"id":"CVE-2023-0464","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0464","date":"2026-11-07","epss":0.03985,"percentile":0.9056}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.couchbase.com/alerts/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230322.txt","https://security.netapp.com/advisory/ntap-20230406-0006/","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-077170.html","https://cert-portal.siemens.com/productcert/html/ssa-337522.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-625862.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-879734.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464","description":"A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints.  Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."}]},{"artifact":{"id":"bcecf49dfefd132c","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.26.0-21.el8_10?arch=x86_64&distro=rhel-8.10&upstream=sqlite-3.26.0-21.el8_10.src.rpm","type":"rpm","version":"3.26.0-21.el8_10","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.26.0-21.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9936","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"sqlite","version":"3.26.0-21.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-9936","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9936","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9936","date":"2026-11-07","epss":0.0535,"percentile":0.92684}],"risk":1.6852499999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-9936","description":"A vulnerability was found in SQLite, where a heap-based buffer over-read occurs in the fts5HashEntrySort function within sqlite3.c, an attacker could exploit this vulnerability by running specially crafted queries, lead to an information leak."},"relatedVulnerabilities":[{"id":"CVE-2019-9936","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9936","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9936","date":"2026-11-07","epss":0.0535,"percentile":0.92684}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html","http://www.securityfocus.com/bid/107562","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/","https://security.gentoo.org/glsa/201908-09","https://security.netapp.com/advisory/ntap-20190416-0005/","https://sqlite.org/src/info/b3fa58dd7403dbd4","https://usn.ubuntu.com/4019-1/","https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114382.html","https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114394.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9936","description":"In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c."}]},{"artifact":{"id":"2740ea74c614de4e","cpes":["cpe:2.3:a:libevent:libevent:2.1.8-5.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libevent:2.1.8-5.el8:*:*:*:*:*:*:*"],"name":"libevent","purl":"pkg:rpm/redhat/libevent@2.1.8-5.el8?arch=x86_64&distro=rhel-8.10&upstream=libevent-2.1.8-5.el8.src.rpm","type":"rpm","version":"2.1.8-5.el8","language":"","licenses":["BSD and ISC"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.1.8-11.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63382","versionConstraint":"< 0:2.1.8-11.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libevent","version":"0:2.1.8-5.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-63382","fix":{"state":"fixed","versions":["0:2.1.8-11.el8_10"],"available":[{"date":"2026-09-17","kind":"first-observed","version":"0:2.1.8-11.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63382","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63382","date":"2026-11-07","epss":0.01991,"percentile":0.80782}],"risk":1.51316,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:67908","link":"https://access.redhat.com/errata/RHSA-2026:67908"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-63382","description":"A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successful exploitation could lead to request smuggling, potentially bypassing access controls or poisoning caches."},"relatedVulnerabilities":[{"id":"CVE-2026-63382","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63382","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63382","date":"2026-11-07","epss":0.01991,"percentile":0.80782}],"urls":["https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6","https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e","https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660","https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63382","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"84c4e558c80e4b90","cpes":["cpe:2.3:a:libarchive:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libarchive-3.3.3-7.el8_10.src.rpm","type":"rpm","version":"3.3.3-7.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000880","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libarchive","version":"0:3.3.3-7.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-1000880","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000880","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000880","date":"2026-11-07","epss":0.0409,"percentile":0.90792}],"risk":1.49285,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-1000880","description":"A vulnerability was found in libarchive, where improper input validation in the _warc_read function in libarchive/archive_read_support_format_warc.c can lead to a denial of service, a remote attacker could exploit this flaw by persuading a victim to open a specially crafted file, causing the application to crash."},"relatedVulnerabilities":[{"id":"CVE-2018-1000880","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000880","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000880","date":"2026-11-07","epss":0.0409,"percentile":0.90792}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html","http://www.securityfocus.com/bid/106324","https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909","https://github.com/libarchive/libarchive/pull/1105","https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/","https://usn.ubuntu.com/3859-1/","https://www.debian.org/security/2018/dsa-4360"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000880","description":"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16866","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-16866","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16866","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16866","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16866","date":"2026-11-07","epss":0.03506,"percentile":0.89258}],"risk":1.45499,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-16866","description":"Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule."},"relatedVulnerabilities":[{"id":"CVE-2019-16866","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16866","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16866","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16866","date":"2026-11-07","epss":0.03506,"percentile":0.89258}],"urls":["https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/","https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt","https://seclists.org/bugtraq/2019/Oct/23","https://usn.ubuntu.com/4149-1/","https://www.debian.org/security/2019/dsa-4544"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16866","description":"Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16866","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-16866","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16866","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16866","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16866","date":"2026-11-07","epss":0.03506,"percentile":0.89258}],"risk":1.45499,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-16866","description":"Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule."},"relatedVulnerabilities":[{"id":"CVE-2019-16866","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16866","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16866","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16866","date":"2026-11-07","epss":0.03506,"percentile":0.89258}],"urls":["https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/","https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt","https://seclists.org/bugtraq/2019/Oct/23","https://usn.ubuntu.com/4149-1/","https://www.debian.org/security/2019/dsa-4544"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16866","description":"Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule."}]},{"artifact":{"id":"c5f7168719c595ce","cpes":["cpe:2.3:a:procps-ng:procps-ng:3.3.15-14.el8:*:*:*:*:*:*:*","cpe:2.3:a:procps-ng:procps_ng:3.3.15-14.el8:*:*:*:*:*:*:*","cpe:2.3:a:procps_ng:procps-ng:3.3.15-14.el8:*:*:*:*:*:*:*","cpe:2.3:a:procps_ng:procps_ng:3.3.15-14.el8:*:*:*:*:*:*:*","cpe:2.3:a:procps:procps-ng:3.3.15-14.el8:*:*:*:*:*:*:*","cpe:2.3:a:procps:procps_ng:3.3.15-14.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:procps-ng:3.3.15-14.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:procps_ng:3.3.15-14.el8:*:*:*:*:*:*:*"],"name":"procps-ng","purl":"pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=rhel-8.10&upstream=procps-ng-3.3.15-14.el8.src.rpm","type":"rpm","version":"3.3.15-14.el8","language":"","licenses":["GPL+ and GPLv2 and GPLv2+ and GPLv3+ and LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1121","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"procps-ng","version":"0:3.3.15-14.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-1121","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1121","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1121","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1121","date":"2026-11-07","epss":0.04105,"percentile":0.90826}],"risk":1.4162249999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-1121","description":"Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries."},"relatedVulnerabilities":[{"id":"CVE-2018-1121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1121","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1121","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1121","date":"2026-11-07","epss":0.04105,"percentile":0.90826}],"urls":["http://seclists.org/oss-sec/2018/q2/122","http://www.securityfocus.com/bid/104214","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1121","https://www.exploit-db.com/exploits/44806/","https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1121","description":"procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also."}]},{"artifact":{"id":"8d28acbe9944600a","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-39537","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2021-39537","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-11-07","epss":0.03243,"percentile":0.88378}],"risk":1.3782750000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-39537","description":"A heap overflow vulnerability has been identified in the ncurses package, particularly in the \"tic\". This flaw results from a lack of proper bounds checking during input processing. By exploiting this boundary error, an attacker can create a malicious file, deceive the victim into opening it using the affected software, and initiate an out-of-bounds write, potentially impacting system availability."},"relatedVulnerabilities":[{"id":"CVE-2021-39537","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-11-07","epss":0.03243,"percentile":0.88378}],"urls":["http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup","http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/43","http://seclists.org/fulldisclosure/2022/Oct/45","https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html","https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html","https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html","https://security.netapp.com/advisory/ntap-20230427-0012/","https://support.apple.com/kb/HT213443","https://support.apple.com/kb/HT213444","https://support.apple.com/kb/HT213488"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."}]},{"artifact":{"id":"740497c732ce2972","cpes":["cpe:2.3:a:ncurses-libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-libs","purl":"pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-39537","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2021-39537","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-11-07","epss":0.03243,"percentile":0.88378}],"risk":1.3782750000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-39537","description":"A heap overflow vulnerability has been identified in the ncurses package, particularly in the \"tic\". This flaw results from a lack of proper bounds checking during input processing. By exploiting this boundary error, an attacker can create a malicious file, deceive the victim into opening it using the affected software, and initiate an out-of-bounds write, potentially impacting system availability."},"relatedVulnerabilities":[{"id":"CVE-2021-39537","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-11-07","epss":0.03243,"percentile":0.88378}],"urls":["http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup","http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/43","http://seclists.org/fulldisclosure/2022/Oct/45","https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html","https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html","https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html","https://security.netapp.com/advisory/ntap-20230427-0012/","https://support.apple.com/kb/HT213443","https://support.apple.com/kb/HT213444","https://support.apple.com/kb/HT213488"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-0727","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-0727","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-11-07","epss":0.03187,"percentile":0.8816}],"risk":1.3544750000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-0727","description":"A flaw was found in OpenSSL. The optional ContentInfo fields can be set to null, even if the \"type\" is a valid value, which can lead to a null dereference error that may cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-0727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-11-07","epss":0.03187,"percentile":0.8816}],"urls":["https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240208-0006/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0727","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-0727","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-11-07","epss":0.03187,"percentile":0.8816}],"risk":1.3544750000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-0727","description":"A flaw was found in OpenSSL. The optional ContentInfo fields can be set to null, even if the \"type\" is a valid value, which can lead to a null dereference error that may cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-0727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-11-07","epss":0.03187,"percentile":0.8816}],"urls":["https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240208-0006/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"9f1348c074e62048","cpes":["cpe:2.3:a:libgcc:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20657","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-20657","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20657","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20657","date":"2026-11-07","epss":0.04004,"percentile":0.90603}],"risk":1.2612599999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-20657","description":"A vulnerability was found in the demangle_template function in GNU libiberty, as distributed in GNU Binutils, where a memory leak could occur, a specially crafted file could cause the application to consume excessive memory, potentially leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2018-20657","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20657","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20657","date":"2026-11-07","epss":0.04004,"percentile":0.90603}],"urls":["http://www.securityfocus.com/bid/106444","https://access.redhat.com/errata/RHSA-2019:3352","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539","https://support.f5.com/csp/article/K62602089"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20657","description":"The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698."}]},{"artifact":{"id":"18d5838298e1194f","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20657","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-20657","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20657","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20657","date":"2026-11-07","epss":0.04004,"percentile":0.90603}],"risk":1.2612599999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-20657","description":"A vulnerability was found in the demangle_template function in GNU libiberty, as distributed in GNU Binutils, where a memory leak could occur, a specially crafted file could cause the application to consume excessive memory, potentially leading to a crash."},"relatedVulnerabilities":[{"id":"CVE-2018-20657","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20657","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20657","date":"2026-11-07","epss":0.04004,"percentile":0.90603}],"urls":["http://www.securityfocus.com/bid/106444","https://access.redhat.com/errata/RHSA-2019:3352","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539","https://support.f5.com/csp/article/K62602089"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20657","description":"The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698."}]},{"artifact":{"id":"84c4e558c80e4b90","cpes":["cpe:2.3:a:libarchive:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libarchive-3.3.3-7.el8_10.src.rpm","type":"rpm","version":"3.3.3-7.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000879","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libarchive","version":"0:3.3.3-7.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-1000879","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000879","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000879","date":"2026-11-07","epss":0.03395,"percentile":0.88897}],"risk":1.239175,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-1000879","description":"A vulnerability was found in libarchive, where a NULL pointer dereference in the archive_acl_from_text_l function in libarchive/archive_acl.c can lead to a denial of service, a remote attacker could exploit this flaw by persuading a victim to open a specially crafted file, causing the application to crash."},"relatedVulnerabilities":[{"id":"CVE-2018-1000879","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000879","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000879","date":"2026-11-07","epss":0.03395,"percentile":0.88897}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html","http://www.securityfocus.com/bid/106324","https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909","https://github.com/libarchive/libarchive/pull/1105","https://github.com/libarchive/libarchive/pull/1105/commits/15bf44fd2c1ad0e3fd87048b3fcc90c4dcff1175","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000879","description":"libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file."}]},{"artifact":{"id":"e189638bd0df4f55","cpes":["cpe:2.3:a:libgcrypt:libgcrypt:1.8.5-8.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcrypt:1.8.5-8.el8_10:*:*:*:*:*:*:*"],"name":"libgcrypt","purl":"pkg:rpm/redhat/libgcrypt@1.8.5-8.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libgcrypt-1.8.5-8.el8_10.src.rpm","type":"rpm","version":"1.8.5-8.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-12904","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libgcrypt","version":"0:1.8.5-8.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-12904","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12904","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12904","date":"2026-11-07","epss":0.02211,"percentile":0.82711}],"risk":1.2049950000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-12904","description":"[Disputed] A vulnerability has been identified in Libgcrypt due to a flaw in its C implementation of AES. This vulnerability enables a remote attacker to perform a flush-and-reload side-channel attack, potentially accessing sensitive information. The vulnerability arises from the availability of physical addresses to other processes, particularly on platforms lacking an assembly-language implementation."},"relatedVulnerabilities":[{"id":"CVE-2019-12904","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12904","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12904","date":"2026-11-07","epss":0.02211,"percentile":0.82711}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00049.html","https://dev.gnupg.org/T4541","https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020","https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12904","description":"In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack"}]},{"artifact":{"id":"bcecf49dfefd132c","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.26.0-21.el8_10?arch=x86_64&distro=rhel-8.10&upstream=sqlite-3.26.0-21.el8_10.src.rpm","type":"rpm","version":"3.26.0-21.el8_10","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.26.0-21.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119586","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"sqlite","version":"3.26.0-21.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-119586","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-07","epss":0.01545,"percentile":0.75137}],"risk":1.181925,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119586","description":"A flaw was found in the SQLite command-line interface. This vulnerability allows an attacker to achieve arbitrary command execution by convincing a user to run the recovery command on a specially crafted database. Because the recovery process fails to sanitize embedded shell instructions within the database schema, piping or re-importing the recovered output into the command-line shell executes operating system commands with the privileges of the running user."},"relatedVulnerabilities":[{"id":"CVE-2026-119586","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-07","epss":0.01545,"percentile":0.75137}],"urls":["https://abraxaslabs.tech/research/sqlite-cli-recover","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586","description":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."}]},{"artifact":{"id":"01ad597771805e8b","cpes":["cpe:2.3:a:systemd:systemd:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd:239-82.el8_10.19:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:rpm/redhat/systemd@239-82.el8_10.19?arch=x86_64&distro=rhel-8.10&upstream=systemd-239-82.el8_10.19.src.rpm","type":"rpm","version":"239-82.el8_10.19","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-20839","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"systemd","version":"0:239-82.el8_10.19"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-20839","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":3.6,"exploitabilityScore":0.7},"version":"3.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20839","date":"2026-11-07","epss":0.02478,"percentile":0.84661}],"risk":1.15227,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-20839","description":"The issue arises from the way systemd handles user passwords during the boot process. Specifically, passwords entered on the console during the system boot (e.g., for unlocking encrypted disks or logging in) could be logged in plaintext if certain conditions are met."},"relatedVulnerabilities":[{"id":"CVE-2018-20839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":3.6,"exploitabilityScore":0.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20839","date":"2026-11-07","epss":0.02478,"percentile":0.84661}],"urls":["http://www.securityfocus.com/bid/108389","https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993","https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f","https://github.com/systemd/systemd/pull/12378","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://security.netapp.com/advisory/ntap-20190530-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20839","description":"systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled."}]},{"artifact":{"id":"7450a4efde9a814b","cpes":["cpe:2.3:a:systemd-libs:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd-libs:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*"],"name":"systemd-libs","purl":"pkg:rpm/redhat/systemd-libs@239-82.el8_10.19?arch=x86_64&distro=rhel-8.10&upstream=systemd-239-82.el8_10.19.src.rpm","type":"rpm","version":"239-82.el8_10.19","language":"","licenses":["LGPLv2+ and MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"239-82.el8_10.19"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20839","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"systemd","version":"239-82.el8_10.19"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-20839","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":3.6,"exploitabilityScore":0.7},"version":"3.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20839","date":"2026-11-07","epss":0.02478,"percentile":0.84661}],"risk":1.15227,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-20839","description":"The issue arises from the way systemd handles user passwords during the boot process. Specifically, passwords entered on the console during the system boot (e.g., for unlocking encrypted disks or logging in) could be logged in plaintext if certain conditions are met."},"relatedVulnerabilities":[{"id":"CVE-2018-20839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":3.6,"exploitabilityScore":0.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20839","date":"2026-11-07","epss":0.02478,"percentile":0.84661}],"urls":["http://www.securityfocus.com/bid/108389","https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993","https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f","https://github.com/systemd/systemd/pull/12378","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://security.netapp.com/advisory/ntap-20190530-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20839","description":"systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled."}]},{"artifact":{"id":"08b8c470e18ca6d2","cpes":["cpe:2.3:a:systemd-pam:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd-pam:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*"],"name":"systemd-pam","purl":"pkg:rpm/redhat/systemd-pam@239-82.el8_10.19?arch=x86_64&distro=rhel-8.10&upstream=systemd-239-82.el8_10.19.src.rpm","type":"rpm","version":"239-82.el8_10.19","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"239-82.el8_10.19"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20839","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"systemd","version":"239-82.el8_10.19"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-20839","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":3.6,"exploitabilityScore":0.7},"version":"3.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20839","date":"2026-11-07","epss":0.02478,"percentile":0.84661}],"risk":1.15227,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-20839","description":"The issue arises from the way systemd handles user passwords during the boot process. Specifically, passwords entered on the console during the system boot (e.g., for unlocking encrypted disks or logging in) could be logged in plaintext if certain conditions are met."},"relatedVulnerabilities":[{"id":"CVE-2018-20839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":3.6,"exploitabilityScore":0.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20839","date":"2026-11-07","epss":0.02478,"percentile":0.84661}],"urls":["http://www.securityfocus.com/bid/108389","https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993","https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f","https://github.com/systemd/systemd/pull/12378","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://security.netapp.com/advisory/ntap-20190530-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20839","description":"systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled."}]},{"artifact":{"id":"8d28acbe9944600a","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19189","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19189","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-11-07","epss":0.02294,"percentile":0.83357}],"risk":1.0896499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19189","description":"A flaw has been identified in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a heap-based buffer overflow, resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2020-19189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-11-07","epss":0.02294,"percentile":0.83357}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc5.md","https://lists.debian.org/debian-lts-announce/2023/09/msg00033.html","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"740497c732ce2972","cpes":["cpe:2.3:a:ncurses-libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-libs","purl":"pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19189","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19189","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-11-07","epss":0.02294,"percentile":0.83357}],"risk":1.0896499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19189","description":"A flaw has been identified in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a heap-based buffer overflow, resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2020-19189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-11-07","epss":0.02294,"percentile":0.83357}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc5.md","https://lists.debian.org/debian-lts-announce/2023/09/msg00033.html","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"0bc0698cf4cd83dd","cpes":["cpe:2.3:a:iputils:iputils:20180629-11.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:iputils:20180629-11.el8:*:*:*:*:*:*:*"],"name":"iputils","purl":"pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=rhel-8.10&upstream=iputils-20180629-11.el8.src.rpm","type":"rpm","version":"20180629-11.el8","language":"","licenses":["BSD and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-47268","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"iputils","version":"0:20180629-11.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-47268","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47268","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-47268","date":"2026-11-07","epss":0.01775,"percentile":0.78325}],"risk":1.020625,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-47268","description":"A flaw was found in iputils ping, where a signed integer overflow occurs in timestamp multiplication. This issue could lead to incorrect timestamp calculations or denial of service when processing crafted ICMP Echo Reply packets."},"relatedVulnerabilities":[{"id":"CVE-2025-47268","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-47268","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-47268","date":"2026-11-07","epss":0.01775,"percentile":0.78325}],"urls":["https://bugzilla.suse.com/show_bug.cgi?id=1242300","https://github.com/Zephkek/ping-rtt-overflow/","https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40","https://github.com/iputils/iputils/issues/584","https://github.com/iputils/iputils/pull/585","https://github.com/iputils/iputils/releases/tag/20250602"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47268","description":"ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp multiplication."}]},{"artifact":{"id":"55281a0c21c596b7","cpes":["cpe:2.3:a:redhat:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=rhel-8.10&epoch=2&upstream=tar-1.30-11.el8_10.src.rpm","type":"rpm","version":"2:1.30-11.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-9923","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"tar","version":"2:1.30-11.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-9923","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9923","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9923","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9923","date":"2026-11-07","epss":0.03152,"percentile":0.88027}],"risk":0.9928799999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-9923","description":"pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers."},"relatedVulnerabilities":[{"id":"CVE-2019-9923","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9923","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9923","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9923","date":"2026-11-07","epss":0.03152,"percentile":0.88027}],"urls":["http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html","http://savannah.gnu.org/bugs/?55369","https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9923","description":"pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers."}]},{"artifact":{"id":"1ed86a8e00e9ac03","cpes":["cpe:2.3:a:libzstd:libzstd:1.4.4-1.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libzstd:1.4.4-1.el8:*:*:*:*:*:*:*"],"name":"libzstd","purl":"pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=rhel-8.10&upstream=zstd-1.4.4-1.el8.src.rpm","type":"rpm","version":"1.4.4-1.el8","language":"","licenses":["BSD and GPLv2"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zstd","version":"1.4.4-1.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-4899","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"zstd","version":"1.4.4-1.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2022-4899","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4899","date":"2026-11-07","epss":0.01588,"percentile":0.75778}],"risk":0.9924999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-4899","description":"A vulnerability was found in zstd. This flaw allows an attacker to supply an empty string as an argument to the command line tool to cause a buffer overrun."},"relatedVulnerabilities":[{"id":"CVE-2022-4899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4899","date":"2026-11-07","epss":0.01588,"percentile":0.75778}],"urls":["https://github.com/facebook/zstd/issues/3200","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/","https://security.netapp.com/advisory/ntap-20230725-0005/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4899","description":"A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun."}]},{"artifact":{"id":"2740ea74c614de4e","cpes":["cpe:2.3:a:libevent:libevent:2.1.8-5.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libevent:2.1.8-5.el8:*:*:*:*:*:*:*"],"name":"libevent","purl":"pkg:rpm/redhat/libevent@2.1.8-5.el8?arch=x86_64&distro=rhel-8.10&upstream=libevent-2.1.8-5.el8.src.rpm","type":"rpm","version":"2.1.8-5.el8","language":"","licenses":["BSD and ISC"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.1.8-11.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63385","versionConstraint":"< 0:2.1.8-11.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libevent","version":"0:2.1.8-5.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-63385","fix":{"state":"fixed","versions":["0:2.1.8-11.el8_10"],"available":[{"date":"2026-09-17","kind":"first-observed","version":"0:2.1.8-11.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63385","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63385","date":"2026-11-07","epss":0.01292,"percentile":0.70439}],"risk":0.98192,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:67908","link":"https://access.redhat.com/errata/RHSA-2026:67908"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-63385","description":"A flaw was found in libevent. The evhttp_decode_uri_internal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes /admin/secret, bypassing path-based access controls. Additionally, evhttp_header_is_valid_value accepts obsolete HTTP header line folding (CRLF followed by SP/HT), which RFC 9112 states new implementations should reject, creating a header injection vector in proxy chains where the frontend rejects obs-fold but libevent accepts it. This could lead to access control bypass, header injection, or request smuggling."},"relatedVulnerabilities":[{"id":"CVE-2026-63385","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63385","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63385","date":"2026-11-07","epss":0.01292,"percentile":0.70439}],"urls":["https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0","https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63385","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition."}]},{"artifact":{"id":"8d28acbe9944600a","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19186","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19186","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19186","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19186","date":"2026-11-07","epss":0.02036,"percentile":0.8121}],"risk":0.9670999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19186","description":"A flaw has been identified in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a buffer over-read, resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2020-19186","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19186","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19186","date":"2026-11-07","epss":0.02036,"percentile":0.8121}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc2.md","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19186","description":"Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"740497c732ce2972","cpes":["cpe:2.3:a:ncurses-libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-libs","purl":"pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19186","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19186","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19186","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19186","date":"2026-11-07","epss":0.02036,"percentile":0.8121}],"risk":0.9670999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19186","description":"A flaw has been identified in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a buffer over-read, resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2020-19186","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19186","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19186","date":"2026-11-07","epss":0.02036,"percentile":0.8121}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc2.md","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19186","description":"Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"93eed475e569196b","cpes":["cpe:2.3:a:platform-python-pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python-pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"platform-python-pip","purl":"pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20225","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-20225","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20225","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20225","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20225","date":"2026-11-07","epss":0.0178,"percentile":0.7838}],"risk":0.9612,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-20225","description":"A vulnerability was found in python-pip due to a flaw in the --extra-index-url option, where it installs the version with the highest version number, even if the user intended to obtain a private package from a private index. Exploitation requires that the package does not already exist in the public index, allowing an attacker to place the package there with an arbitrary version number."},"relatedVulnerabilities":[{"id":"CVE-2018-20225","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20225","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20225","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20225","date":"2026-11-07","epss":0.0178,"percentile":0.7838}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1835736","https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html","https://lists.apache.org/thread.html/rb1adce798445facd032870d644eb39c4baaf9c4a7dd5477d12bb6ab2%40%3Cgithub.arrow.apache.org%3E","https://pip.pypa.io/en/stable/news/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20225","description":"An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely"}]},{"artifact":{"id":"fa83cdeeda4e9e6a","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20225","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-20225","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20225","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20225","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20225","date":"2026-11-07","epss":0.0178,"percentile":0.7838}],"risk":0.9612,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-20225","description":"A vulnerability was found in python-pip due to a flaw in the --extra-index-url option, where it installs the version with the highest version number, even if the user intended to obtain a private package from a private index. Exploitation requires that the package does not already exist in the public index, allowing an attacker to place the package there with an arbitrary version number."},"relatedVulnerabilities":[{"id":"CVE-2018-20225","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20225","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20225","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20225","date":"2026-11-07","epss":0.0178,"percentile":0.7838}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1835736","https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html","https://lists.apache.org/thread.html/rb1adce798445facd032870d644eb39c4baaf9c4a7dd5477d12bb6ab2%40%3Cgithub.arrow.apache.org%3E","https://pip.pypa.io/en/stable/news/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20225","description":"An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely"}]},{"artifact":{"id":"8d28acbe9944600a","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19187","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19187","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19187","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19187","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"risk":0.9219750000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19187","description":"A flaw was found in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a heap-based buffer overflow, resulting in an application crash, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-19187","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19187","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19187","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc3.md","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19187","description":"Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"8d28acbe9944600a","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19188","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19188","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19188","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19188","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"risk":0.9219750000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19188","description":"A flaw was found in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a stack-based buffer overflow, resulting in an application crash, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-19188","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19188","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19188","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc4.md","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19188","description":"Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"8d28acbe9944600a","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19190","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19190","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19190","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"risk":0.9219750000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19190","description":"A flaw has been identified in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a heap-based buffer overflow, resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2020-19190","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19190","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19190","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc6.md","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19190","description":"Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"740497c732ce2972","cpes":["cpe:2.3:a:ncurses-libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-libs","purl":"pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19187","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19187","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19187","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19187","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"risk":0.9219750000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19187","description":"A flaw was found in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a heap-based buffer overflow, resulting in an application crash, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-19187","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19187","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19187","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc3.md","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19187","description":"Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"740497c732ce2972","cpes":["cpe:2.3:a:ncurses-libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-libs","purl":"pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19188","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19188","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19188","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19188","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"risk":0.9219750000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19188","description":"A flaw was found in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a stack-based buffer overflow, resulting in an application crash, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-19188","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19188","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19188","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc4.md","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19188","description":"Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"740497c732ce2972","cpes":["cpe:2.3:a:ncurses-libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-libs","purl":"pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19190","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19190","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19190","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19190","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"risk":0.9219750000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19190","description":"A flaw has been identified in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a heap-based buffer overflow, resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2020-19190","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19190","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19190","date":"2026-11-07","epss":0.01941,"percentile":0.80251}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc6.md","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19190","description":"Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"8d28acbe9944600a","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19185","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19185","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19185","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19185","date":"2026-11-07","epss":0.01941,"percentile":0.8025}],"risk":0.9219750000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19185","description":"A flaw has been identified in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a heap-based buffer overflow, resulting in an application crash, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-19185","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19185","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19185","date":"2026-11-07","epss":0.01941,"percentile":0.8025}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc1.md","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19185","description":"Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"740497c732ce2972","cpes":["cpe:2.3:a:ncurses-libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-libs","purl":"pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19185","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-19185","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19185","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19185","date":"2026-11-07","epss":0.01941,"percentile":0.8025}],"risk":0.9219750000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-19185","description":"A flaw has been identified in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a heap-based buffer overflow, resulting in an application crash, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-19185","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19185","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19185","date":"2026-11-07","epss":0.01941,"percentile":0.8025}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc1.md","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19185","description":"Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-0466","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-0466","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0466","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-0466","date":"2026-11-07","epss":0.01772,"percentile":0.78283}],"risk":0.91258,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-0466","description":"A flaw was found in OpenSSL. The X509_VERIFY_PARAM_add0_policy() function is documented to enable the certificate policy check when doing certificate verification implicitly. However, implementing the function does not enable the check, allowing certificates with invalid or incorrect policies to pass the certificate verification. Suddenly enabling the policy check could break existing deployments, so it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. The applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications."},"relatedVulnerabilities":[{"id":"CVE-2023-0466","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0466","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-0466","date":"2026-11-07","epss":0.01772,"percentile":0.78283}],"urls":["http://www.openwall.com/lists/oss-security/2023/09/28/4","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230414-0001/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230328.txt","https://cert-portal.siemens.com/productcert/html/ssa-337522.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-625862.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-879734.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0466","description":"The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-0466","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-0466","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0466","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-0466","date":"2026-11-07","epss":0.01772,"percentile":0.78283}],"risk":0.91258,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-0466","description":"A flaw was found in OpenSSL. The X509_VERIFY_PARAM_add0_policy() function is documented to enable the certificate policy check when doing certificate verification implicitly. However, implementing the function does not enable the check, allowing certificates with invalid or incorrect policies to pass the certificate verification. Suddenly enabling the policy check could break existing deployments, so it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. The applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications."},"relatedVulnerabilities":[{"id":"CVE-2023-0466","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0466","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-0466","date":"2026-11-07","epss":0.01772,"percentile":0.78283}],"urls":["http://www.openwall.com/lists/oss-security/2023/09/28/4","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230414-0001/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230328.txt","https://cert-portal.siemens.com/productcert/html/ssa-337522.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-625862.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-879734.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0466","description":"The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications."}]},{"artifact":{"id":"01ad597771805e8b","cpes":["cpe:2.3:a:systemd:systemd:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd:239-82.el8_10.19:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:rpm/redhat/systemd@239-82.el8_10.19?arch=x86_64&distro=rhel-8.10&upstream=systemd-239-82.el8_10.19.src.rpm","type":"rpm","version":"239-82.el8_10.19","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3997","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"systemd","version":"0:239-82.el8_10.19"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2021-3997","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3997","date":"2026-11-07","epss":0.01735,"percentile":0.77793}],"risk":0.9108750000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-3997","description":"A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp."},"relatedVulnerabilities":[{"id":"CVE-2021-3997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3997","date":"2026-11-07","epss":0.01735,"percentile":0.77793}],"urls":["https://access.redhat.com/security/cve/CVE-2021-3997","https://bugzilla.redhat.com/show_bug.cgi?id=2024639","https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1","https://security.gentoo.org/glsa/202305-15","https://www.openwall.com/lists/oss-security/2022/01/10/2","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3997","description":"A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp."}]},{"artifact":{"id":"7450a4efde9a814b","cpes":["cpe:2.3:a:systemd-libs:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd-libs:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*"],"name":"systemd-libs","purl":"pkg:rpm/redhat/systemd-libs@239-82.el8_10.19?arch=x86_64&distro=rhel-8.10&upstream=systemd-239-82.el8_10.19.src.rpm","type":"rpm","version":"239-82.el8_10.19","language":"","licenses":["LGPLv2+ and MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"239-82.el8_10.19"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3997","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"systemd","version":"239-82.el8_10.19"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2021-3997","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3997","date":"2026-11-07","epss":0.01735,"percentile":0.77793}],"risk":0.9108750000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-3997","description":"A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp."},"relatedVulnerabilities":[{"id":"CVE-2021-3997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3997","date":"2026-11-07","epss":0.01735,"percentile":0.77793}],"urls":["https://access.redhat.com/security/cve/CVE-2021-3997","https://bugzilla.redhat.com/show_bug.cgi?id=2024639","https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1","https://security.gentoo.org/glsa/202305-15","https://www.openwall.com/lists/oss-security/2022/01/10/2","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3997","description":"A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp."}]},{"artifact":{"id":"08b8c470e18ca6d2","cpes":["cpe:2.3:a:systemd-pam:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd-pam:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*"],"name":"systemd-pam","purl":"pkg:rpm/redhat/systemd-pam@239-82.el8_10.19?arch=x86_64&distro=rhel-8.10&upstream=systemd-239-82.el8_10.19.src.rpm","type":"rpm","version":"239-82.el8_10.19","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"239-82.el8_10.19"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3997","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"systemd","version":"239-82.el8_10.19"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2021-3997","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3997","date":"2026-11-07","epss":0.01735,"percentile":0.77793}],"risk":0.9108750000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-3997","description":"A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp."},"relatedVulnerabilities":[{"id":"CVE-2021-3997","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3997","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3997","date":"2026-11-07","epss":0.01735,"percentile":0.77793}],"urls":["https://access.redhat.com/security/cve/CVE-2021-3997","https://bugzilla.redhat.com/show_bug.cgi?id=2024639","https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1","https://security.gentoo.org/glsa/202305-15","https://www.openwall.com/lists/oss-security/2022/01/10/2","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3997","description":"A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp."}]},{"artifact":{"id":"3daf927dec9eda42","cpes":["cpe:2.3:a:gnutls:gnutls:3.6.16-8.el8_10.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.6.16-8.el8_10.6:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=rhel-8.10&upstream=gnutls-3.6.16-8.el8_10.6.src.rpm","type":"rpm","version":"3.6.16-8.el8_10.6","language":"","licenses":["GPLv3+ and LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-4209","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gnutls","version":"0:3.6.16-8.el8_10.6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2021-4209","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4209","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-4209","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-4209","date":"2026-11-07","epss":0.01908,"percentile":0.79888}],"risk":0.9063,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-4209","description":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances."},"relatedVulnerabilities":[{"id":"CVE-2021-4209","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4209","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-4209","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-4209","date":"2026-11-07","epss":0.01908,"percentile":0.79888}],"urls":["https://access.redhat.com/security/cve/CVE-2021-4209","https://bugzilla.redhat.com/show_bug.cgi?id=2044156","https://gitlab.com/gnutls/gnutls/-/commit/3db352734472d851318944db13be73da61300568","https://gitlab.com/gnutls/gnutls/-/issues/1306","https://gitlab.com/gnutls/gnutls/-/merge_requests/1503","https://security.netapp.com/advisory/ntap-20220915-0005/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-4209","description":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.16.2-5.14.el8_10.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-81642","versionConstraint":"< 0:1.16.2-5.14.el8_10.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-81642","fix":{"state":"fixed","versions":["0:1.16.2-5.14.el8_10.4"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"0:1.16.2-5.14.el8_10.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81642","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-81642","date":"2026-11-07","epss":0.00962,"percentile":0.61843}],"risk":0.90428,"urls":[],"severity":"Critical","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:70754","link":"https://access.redhat.com/errata/RHSA-2026:70754"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-81642","description":"A flaw was found in Unbound's DNSSEC validator. A remote attacker can exploit this vulnerability by controlling a malicious zone and sending a specially crafted DNSKEY record. This can lead to a heap buffer overflow, potentially resulting in a denial of service or remote code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-81642","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81642","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-81642","date":"2026-11-07","epss":0.00962,"percentile":0.61843}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81642","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.16.2-5.14.el8_10.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-81642","versionConstraint":"< 0:1.16.2-5.14.el8_10.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-81642","fix":{"state":"fixed","versions":["0:1.16.2-5.14.el8_10.4"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"0:1.16.2-5.14.el8_10.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81642","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-81642","date":"2026-11-07","epss":0.00962,"percentile":0.61843}],"risk":0.90428,"urls":[],"severity":"Critical","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:70754","link":"https://access.redhat.com/errata/RHSA-2026:70754"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-81642","description":"A flaw was found in Unbound's DNSSEC validator. A remote attacker can exploit this vulnerability by controlling a malicious zone and sending a specially crafted DNSKEY record. This can lead to a heap buffer overflow, potentially resulting in a denial of service or remote code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-81642","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81642","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-81642","date":"2026-11-07","epss":0.00962,"percentile":0.61843}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81642","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.8,"impactScore":3.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-07","epss":0.02303,"percentile":0.83428}],"risk":0.89817,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7592","description":"A flaw was found in the `http.cookies` module in the Python package. When parsing cookies that contain backslashes, under certain circumstances, the module uses an algorithm with quadratic complexity, leading to excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-07","epss":0.02303,"percentile":0.83428}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7592","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-7592","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.8,"impactScore":3.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-07","epss":0.02303,"percentile":0.83428}],"risk":0.89817,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-7592","description":"A flaw was found in the `http.cookies` module in the Python package. When parsing cookies that contain backslashes, under certain circumstances, the module uses an algorithm with quadratic complexity, leading to excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2024-7592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7592","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2024-7592","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7592","date":"2026-11-07","epss":0.02303,"percentile":0.83428}],"urls":["https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621","https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef","https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06","https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a","https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f","https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774","https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1","https://github.com/python/cpython/issues/123067","https://github.com/python/cpython/pull/123075","https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20241018-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7592","description":"There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-07","epss":0.01966,"percentile":0.80485}],"risk":0.8748700000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-11053","description":"A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host."},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-07","epss":0.01966,"percentile":0.80485}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11053","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-07","epss":0.01966,"percentile":0.80485}],"risk":0.8748700000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-11053","description":"A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host."},"relatedVulnerabilities":[{"id":"CVE-2024-11053","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-11-07","epss":0.01966,"percentile":0.80485}],"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-212953.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."}]},{"artifact":{"id":"14a17f831ce6d6c1","cpes":["cpe:2.3:a:nmap-ncat:nmap-ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:nmap-ncat:nmap_ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:nmap_ncat:nmap-ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:nmap_ncat:nmap_ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nmap-ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nmap_ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:nmap:nmap-ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:nmap:nmap_ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*"],"name":"nmap-ncat","purl":"pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=rhel-8.10&epoch=2&upstream=nmap-7.92-2.el8_10.src.rpm","type":"rpm","version":"2:7.92-2.el8_10","language":"","licenses":["Nmap"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nmap","version":"7.92-2.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58058","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"nmap","version":"7.92-2.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-58058","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58058","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58058","date":"2026-11-07","epss":0.01454,"percentile":0.7361}],"risk":0.83605,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-58058","description":"A flaw was found in Nmap. A remote attacker or a scanned target can send a specially crafted IPv6 response with a truncated extension header. This can lead to an integer underflow, causing out-of-bounds reads and a denial of service (DoS) due to a crash during raw IPv6 scans."},"relatedVulnerabilities":[{"id":"CVE-2026-58058","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58058","cwe":"CWE-191","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58058","date":"2026-11-07","epss":0.01454,"percentile":0.7361}],"urls":["https://github.com/bikini/exploitarium/tree/main/nmap-ipv6-extlen-wrap-poc","https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83","https://nmap.org/changelog.html","https://www.vulncheck.com/advisories/nmap-integer-underflow-in-ipv6-extension-header-parsing"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58058","description":"Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-27534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-27534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-27534","date":"2026-11-07","epss":0.0244,"percentile":0.84398}],"risk":0.8173999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-27534","description":"A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user."},"relatedVulnerabilities":[{"id":"CVE-2023-27534","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-27534","date":"2026-11-07","epss":0.0244,"percentile":0.84398}],"urls":["https://hackerone.com/reports/1892351","https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230420-0012/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-806742.html","https://cert-portal.siemens.com/productcert/html/ssa-943925.html","https://advisory.splunk.com/advisories/SVD-2023-0809","https://curl.se/docs/CVE-2023-27534.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27534","description":"A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27534","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-27534","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-27534","date":"2026-11-07","epss":0.0244,"percentile":0.84398}],"risk":0.8173999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-27534","description":"A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user."},"relatedVulnerabilities":[{"id":"CVE-2023-27534","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-27534","date":"2026-11-07","epss":0.0244,"percentile":0.84398}],"urls":["https://hackerone.com/reports/1892351","https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230420-0012/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-806742.html","https://cert-portal.siemens.com/productcert/html/ssa-943925.html","https://advisory.splunk.com/advisories/SVD-2023-0809","https://curl.se/docs/CVE-2023-27534.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27534","description":"A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-0465","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-0465","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0465","date":"2026-11-07","epss":0.01772,"percentile":0.78283}],"risk":0.73538,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-0465","description":"A flaw was found in OpenSSL. Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. OpenSSL and other certificate policy checks silently ignore invalid certificate policies in leaf certificates that are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[{"id":"CVE-2023-0465","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0465","date":"2026-11-07","epss":0.01772,"percentile":0.78283}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230414-0001/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230328.txt","https://cert-portal.siemens.com/productcert/html/ssa-337522.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-625862.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-879734.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0465","description":"Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-0465","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-0465","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0465","date":"2026-11-07","epss":0.01772,"percentile":0.78283}],"risk":0.73538,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-0465","description":"A flaw was found in OpenSSL. Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. OpenSSL and other certificate policy checks silently ignore invalid certificate policies in leaf certificates that are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[{"id":"CVE-2023-0465","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0465","date":"2026-11-07","epss":0.01772,"percentile":0.78283}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230414-0001/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230328.txt","https://cert-portal.siemens.com/productcert/html/ssa-337522.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-625862.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-879734.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0465","description":"Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."}]},{"artifact":{"id":"9f1348c074e62048","cpes":["cpe:2.3:a:libgcc:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-14250","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-14250","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14250","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-14250","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14250","date":"2026-11-07","epss":0.02325,"percentile":0.83593}],"risk":0.7323749999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-14250","description":"This issue resides on libiberty code, a part of binutils, distributed with different versions of RH software. The vulnerability is triggered when the shstrndx (Section Header String Table Index) is zero in the ELF file. This specific condition leads to the integer overflow and subsequent buffer overflow."},"relatedVulnerabilities":[{"id":"CVE-2019-14250","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14250","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-14250","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14250","date":"2026-11-07","epss":0.02325,"percentile":0.83593}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html","http://www.securityfocus.com/bid/109354","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90924","https://gcc.gnu.org/ml/gcc-patches/2019-07/msg01003.html","https://security.gentoo.org/glsa/202007-39","https://security.netapp.com/advisory/ntap-20190822-0002/","https://usn.ubuntu.com/4326-1/","https://usn.ubuntu.com/4336-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14250","description":"An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow."}]},{"artifact":{"id":"18d5838298e1194f","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-14250","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-14250","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14250","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-14250","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14250","date":"2026-11-07","epss":0.02325,"percentile":0.83593}],"risk":0.7323749999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-14250","description":"This issue resides on libiberty code, a part of binutils, distributed with different versions of RH software. The vulnerability is triggered when the shstrndx (Section Header String Table Index) is zero in the ELF file. This specific condition leads to the integer overflow and subsequent buffer overflow."},"relatedVulnerabilities":[{"id":"CVE-2019-14250","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14250","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-14250","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14250","date":"2026-11-07","epss":0.02325,"percentile":0.83593}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html","http://www.securityfocus.com/bid/109354","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90924","https://gcc.gnu.org/ml/gcc-patches/2019-07/msg01003.html","https://security.gentoo.org/glsa/202007-39","https://security.netapp.com/advisory/ntap-20190822-0002/","https://usn.ubuntu.com/4326-1/","https://usn.ubuntu.com/4336-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14250","description":"An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow."}]},{"artifact":{"id":"05c95867591d6a7e","cpes":["cpe:2.3:a:libtasn1:libtasn1:4.13-6.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libtasn1:4.13-6.el8_10:*:*:*:*:*:*:*"],"name":"libtasn1","purl":"pkg:rpm/redhat/libtasn1@4.13-6.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libtasn1-4.13-6.el8_10.src.rpm","type":"rpm","version":"4.13-6.el8_10","language":"","licenses":["GPLv3+ and LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000654","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libtasn1","version":"0:4.13-6.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-1000654","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000654","date":"2026-11-07","epss":0.01982,"percentile":0.80681}],"risk":0.6937,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-1000654","description":"A vulnerability was found in GNU Libtasn1, where a resource management issue can lead to a denial of service, here an attacker could exploit this flaw by persuading a victim to parse a specially crafted file, exhausting all available CPU resources."},"relatedVulnerabilities":[{"id":"CVE-2018-1000654","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000654","date":"2026-11-07","epss":0.01982,"percentile":0.80681}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html","http://www.securityfocus.com/bid/105151","https://gitlab.com/gnutls/libtasn1/issues/4","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000654","description":"GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file."}]},{"artifact":{"id":"13b38de60a9fc1f5","cpes":["cpe:2.3:a:redhat:wget:1.19.5-16.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:wget:wget:1.19.5-16.el8_10:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:rpm/redhat/wget@1.19.5-16.el8_10?arch=x86_64&distro=rhel-8.10&upstream=wget-1.19.5-16.el8_10.src.rpm","type":"rpm","version":"1.19.5-16.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-31879","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"wget","version":"0:1.19.5-16.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2021-31879","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31879","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31879","date":"2026-11-07","epss":0.01104,"percentile":0.65958}],"risk":0.6347999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-31879","description":"A flaw was found in wget. If wget sends an Authorization header as part of a query and receives an HTTP REDIRECT to a third party in return, the Authorization header will be forwarded as part of the redirected request. This issue creates a password leak, as the second server receives the password. The highest threat from this vulnerability is confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2021-31879","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31879","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31879","date":"2026-11-07","epss":0.01104,"percentile":0.65958}],"urls":["https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html","https://security.netapp.com/advisory/ntap-20210618-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31879","description":"GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007."}]},{"artifact":{"id":"e189638bd0df4f55","cpes":["cpe:2.3:a:libgcrypt:libgcrypt:1.8.5-8.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcrypt:1.8.5-8.el8_10:*:*:*:*:*:*:*"],"name":"libgcrypt","purl":"pkg:rpm/redhat/libgcrypt@1.8.5-8.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libgcrypt-1.8.5-8.el8_10.src.rpm","type":"rpm","version":"1.8.5-8.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2236","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libgcrypt","version":"0:1.8.5-8.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-2236","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2236","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-2236","date":"2026-11-07","epss":0.0114,"percentile":0.66809}],"risk":0.6213000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-2236","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts."},"relatedVulnerabilities":[{"id":"CVE-2024-2236","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2236","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-2236","date":"2026-11-07","epss":0.0114,"percentile":0.66809}],"urls":["https://access.redhat.com/errata/RHSA-2024:9404","https://access.redhat.com/errata/RHSA-2025:3530","https://access.redhat.com/errata/RHSA-2025:3534","https://access.redhat.com/security/cve/CVE-2024-2236","https://bugzilla.redhat.com/show_bug.cgi?id=2245218","https://bugzilla.redhat.com/show_bug.cgi?id=2268268","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2236","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts."}]},{"artifact":{"id":"01ad597771805e8b","cpes":["cpe:2.3:a:systemd:systemd:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd:239-82.el8_10.19:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:rpm/redhat/systemd@239-82.el8_10.19?arch=x86_64&distro=rhel-8.10&upstream=systemd-239-82.el8_10.19.src.rpm","type":"rpm","version":"239-82.el8_10.19","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-4598","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"systemd","version":"0:239-82.el8_10.19"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-4598","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-07","epss":0.01277,"percentile":0.70129}],"risk":0.6193449999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2025-4598","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-07","epss":0.01277,"percentile":0.70129}],"urls":["https://access.redhat.com/errata/RHSA-2025:22660","https://access.redhat.com/errata/RHSA-2025:22868","https://access.redhat.com/errata/RHSA-2025:23227","https://access.redhat.com/errata/RHSA-2025:23234","https://access.redhat.com/errata/RHSA-2026:0414","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:18153","https://access.redhat.com/security/cve/CVE-2025-4598","https://bugzilla.redhat.com/show_bug.cgi?id=2369242","https://www.openwall.com/lists/oss-security/2025/05/29/3","http://seclists.org/fulldisclosure/2025/Jun/9","http://www.openwall.com/lists/oss-security/2025/06/05/1","http://www.openwall.com/lists/oss-security/2025/06/05/3","http://www.openwall.com/lists/oss-security/2025/08/18/3","https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598","https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/","https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html","https://www.openwall.com/lists/oss-security/2025/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."}]},{"artifact":{"id":"7450a4efde9a814b","cpes":["cpe:2.3:a:systemd-libs:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd-libs:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-libs:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_libs:239-82.el8_10.19:*:*:*:*:*:*:*"],"name":"systemd-libs","purl":"pkg:rpm/redhat/systemd-libs@239-82.el8_10.19?arch=x86_64&distro=rhel-8.10&upstream=systemd-239-82.el8_10.19.src.rpm","type":"rpm","version":"239-82.el8_10.19","language":"","licenses":["LGPLv2+ and MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"239-82.el8_10.19"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4598","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"systemd","version":"239-82.el8_10.19"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-4598","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-07","epss":0.01277,"percentile":0.70129}],"risk":0.6193449999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2025-4598","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-07","epss":0.01277,"percentile":0.70129}],"urls":["https://access.redhat.com/errata/RHSA-2025:22660","https://access.redhat.com/errata/RHSA-2025:22868","https://access.redhat.com/errata/RHSA-2025:23227","https://access.redhat.com/errata/RHSA-2025:23234","https://access.redhat.com/errata/RHSA-2026:0414","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:18153","https://access.redhat.com/security/cve/CVE-2025-4598","https://bugzilla.redhat.com/show_bug.cgi?id=2369242","https://www.openwall.com/lists/oss-security/2025/05/29/3","http://seclists.org/fulldisclosure/2025/Jun/9","http://www.openwall.com/lists/oss-security/2025/06/05/1","http://www.openwall.com/lists/oss-security/2025/06/05/3","http://www.openwall.com/lists/oss-security/2025/08/18/3","https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598","https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/","https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html","https://www.openwall.com/lists/oss-security/2025/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."}]},{"artifact":{"id":"08b8c470e18ca6d2","cpes":["cpe:2.3:a:systemd-pam:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd-pam:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd-pam:239-82.el8_10.19:*:*:*:*:*:*:*","cpe:2.3:a:redhat:systemd_pam:239-82.el8_10.19:*:*:*:*:*:*:*"],"name":"systemd-pam","purl":"pkg:rpm/redhat/systemd-pam@239-82.el8_10.19?arch=x86_64&distro=rhel-8.10&upstream=systemd-239-82.el8_10.19.src.rpm","type":"rpm","version":"239-82.el8_10.19","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"239-82.el8_10.19"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4598","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"systemd","version":"239-82.el8_10.19"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-4598","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-07","epss":0.01277,"percentile":0.70129}],"risk":0.6193449999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."},"relatedVulnerabilities":[{"id":"CVE-2025-4598","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-07","epss":0.01277,"percentile":0.70129}],"urls":["https://access.redhat.com/errata/RHSA-2025:22660","https://access.redhat.com/errata/RHSA-2025:22868","https://access.redhat.com/errata/RHSA-2025:23227","https://access.redhat.com/errata/RHSA-2025:23234","https://access.redhat.com/errata/RHSA-2026:0414","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:18153","https://access.redhat.com/security/cve/CVE-2025-4598","https://bugzilla.redhat.com/show_bug.cgi?id=2369242","https://www.openwall.com/lists/oss-security/2025/05/29/3","http://seclists.org/fulldisclosure/2025/Jun/9","http://www.openwall.com/lists/oss-security/2025/06/05/1","http://www.openwall.com/lists/oss-security/2025/06/05/3","http://www.openwall.com/lists/oss-security/2025/08/18/3","https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598","https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/","https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html","https://www.openwall.com/lists/oss-security/2025/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1:1.1.1k-18.el8_6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 1:1.1.1k-18.el8_6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["1:1.1.1k-18.el8_6"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1:1.1.1k-18.el8_6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-07","epss":0.00831,"percentile":0.57806}],"risk":0.619095,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:85968","link":"https://access.redhat.com/errata/RHSA-2026:85968"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84782","description":"A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process."},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-07","epss":0.00831,"percentile":0.57806}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1:1.1.1k-18.el8_6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 1:1.1.1k-18.el8_6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["1:1.1.1k-18.el8_6"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1:1.1.1k-18.el8_6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-07","epss":0.00831,"percentile":0.57806}],"risk":0.619095,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:85968","link":"https://access.redhat.com/errata/RHSA-2026:85968"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84782","description":"A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process."},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-07","epss":0.00831,"percentile":0.57806}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"13b38de60a9fc1f5","cpes":["cpe:2.3:a:redhat:wget:1.19.5-16.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:wget:wget:1.19.5-16.el8_10:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:rpm/redhat/wget@1.19.5-16.el8_10?arch=x86_64&distro=rhel-8.10&upstream=wget-1.19.5-16.el8_10.src.rpm","type":"rpm","version":"1.19.5-16.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-10524","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"wget","version":"0:1.19.5-16.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-10524","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":3.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10524","cwe":"CWE-918","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-10524","date":"2026-11-07","epss":0.01071,"percentile":0.65062}],"risk":0.615825,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-10524","description":"A flaw was found in the Wget package. Wget might issue an FTP request to a different host in configurations where the HTTP shorthand format is used with user-provided input. An attacker may be able to use specially crafted input to cause Wget to access an arbitrary host."},"relatedVulnerabilities":[{"id":"CVE-2024-10524","cvss":[{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":3.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10524","cwe":"CWE-918","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-10524","date":"2026-11-07","epss":0.01071,"percentile":0.65062}],"urls":["https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778","https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/","https://seclists.org/oss-sec/2024/q4/107","http://www.openwall.com/lists/oss-security/2024/11/18/6","https://security.netapp.com/advisory/ntap-20250321-0007/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10524","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.16.2-5.14.el8_10.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82717","versionConstraint":"< 0:1.16.2-5.14.el8_10.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-82717","fix":{"state":"fixed","versions":["0:1.16.2-5.14.el8_10.4"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"0:1.16.2-5.14.el8_10.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82717","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-82717","date":"2026-11-07","epss":0.00782,"percentile":0.56223}],"risk":0.6099600000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:70754","link":"https://access.redhat.com/errata/RHSA-2026:70754"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82717","description":"A flaw was found in Unbound. Improper handling of buffer positions and compression pointers in Unbound's CNAME synthesis allows a remote attacker to corrupt heap memory via upstream DNS responses. This vulnerability can result in a denial of service (DoS) or, under specific conditions, remote code execution (RCE)."},"relatedVulnerabilities":[{"id":"CVE-2026-82717","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82717","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-82717","date":"2026-11-07","epss":0.00782,"percentile":0.56223}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82717","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.16.2-5.14.el8_10.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82717","versionConstraint":"< 0:1.16.2-5.14.el8_10.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-82717","fix":{"state":"fixed","versions":["0:1.16.2-5.14.el8_10.4"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"0:1.16.2-5.14.el8_10.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82717","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-82717","date":"2026-11-07","epss":0.00782,"percentile":0.56223}],"risk":0.6099600000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:70754","link":"https://access.redhat.com/errata/RHSA-2026:70754"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82717","description":"A flaw was found in Unbound. Improper handling of buffer positions and compression pointers in Unbound's CNAME synthesis allows a remote attacker to corrupt heap memory via upstream DNS responses. This vulnerability can result in a denial of service (DoS) or, under specific conditions, remote code execution (RCE)."},"relatedVulnerabilities":[{"id":"CVE-2026-82717","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82717","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-82717","date":"2026-11-07","epss":0.00782,"percentile":0.56223}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82717","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33655","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-33655","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33655","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33655","date":"2026-11-07","epss":0.01743,"percentile":0.77905}],"risk":0.583905,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-33655","description":"A DNSBomb flaw was found in the unbound package. The DNSBomb attack works by sending low-rate spoofed queries for a malicious zone to Unbound. By controlling the delay of the malicious authoritative answers, Unbound slowly accumulates pending answers for the spoofed addresses. When the authoritative answers become available to Unbound at the same time, Unbound starts serving all the accumulated queries. This results in large-sized, concentrated response bursts to the spoofed addresses."},"relatedVulnerabilities":[{"id":"CVE-2024-33655","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33655","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33655","date":"2026-11-07","epss":0.01743,"percentile":0.77905}],"urls":["https://alas.aws.amazon.com/ALAS-2024-1934.html","https://datatracker.ietf.org/doc/html/rfc1035","https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de","https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-120","https://gitlab.isc.org/isc-projects/bind9/-/issues/4398","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/","https://meterpreter.org/researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features/","https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt","https://nlnetlabs.nl/projects/unbound/security-advisories/","https://sp2024.ieee-security.org/accepted-papers.html","https://www.isc.org/blogs/2024-dnsbomb/","https://lists.debian.org/debian-lts-announce/2025/08/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33655","description":"The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the \"DNSBomb\" issue."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-33655","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-33655","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33655","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33655","date":"2026-11-07","epss":0.01743,"percentile":0.77905}],"risk":0.583905,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-33655","description":"A DNSBomb flaw was found in the unbound package. The DNSBomb attack works by sending low-rate spoofed queries for a malicious zone to Unbound. By controlling the delay of the malicious authoritative answers, Unbound slowly accumulates pending answers for the spoofed addresses. When the authoritative answers become available to Unbound at the same time, Unbound starts serving all the accumulated queries. This results in large-sized, concentrated response bursts to the spoofed addresses."},"relatedVulnerabilities":[{"id":"CVE-2024-33655","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-33655","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-33655","date":"2026-11-07","epss":0.01743,"percentile":0.77905}],"urls":["https://alas.aws.amazon.com/ALAS-2024-1934.html","https://datatracker.ietf.org/doc/html/rfc1035","https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de","https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-120","https://gitlab.isc.org/isc-projects/bind9/-/issues/4398","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/","https://meterpreter.org/researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features/","https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt","https://nlnetlabs.nl/projects/unbound/security-advisories/","https://sp2024.ieee-security.org/accepted-papers.html","https://www.isc.org/blogs/2024-dnsbomb/","https://lists.debian.org/debian-lts-announce/2025/08/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-33655","description":"The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the \"DNSBomb\" issue."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1:1.1.1k-18.el8_6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 1:1.1.1k-18.el8_6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["1:1.1.1k-18.el8_6"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1:1.1.1k-18.el8_6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-07","epss":0.00916,"percentile":0.60419}],"risk":0.5725,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:85968","link":"https://access.redhat.com/errata/RHSA-2026:85968"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-63072","description":"A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-07","epss":0.00916,"percentile":0.60419}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1:1.1.1k-18.el8_6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 1:1.1.1k-18.el8_6 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["1:1.1.1k-18.el8_6"],"available":[{"date":"2026-10-21","kind":"first-observed","version":"1:1.1.1k-18.el8_6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-07","epss":0.00916,"percentile":0.60419}],"risk":0.5725,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:85968","link":"https://access.redhat.com/errata/RHSA-2026:85968"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-63072","description":"A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-07","epss":0.00916,"percentile":0.60419}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-11-07","epss":0.01104,"percentile":0.65973}],"risk":0.56856,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75806","description":"A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by terminating an active Datagram Transport Layer Security (DTLS) session. By sending an undersized network packet that is shorter than the expected cryptographic overhead, the record processing layer fails to validate the packet length and misinterprets the packet as an internal error rather than an authentication failure. This improper handling triggers a fatal alert that unexpectedly closes the targeted connection without requiring valid encryption keys."},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-11-07","epss":0.01104,"percentile":0.65973}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-11-07","epss":0.01104,"percentile":0.65973}],"risk":0.56856,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75806","description":"A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by terminating an active Datagram Transport Layer Security (DTLS) session. By sending an undersized network packet that is shorter than the expected cryptographic overhead, the record processing layer fails to validate the packet length and misinterprets the packet as an internal error rather than an authentication failure. This improper handling triggers a fatal alert that unexpectedly closes the targeted connection without requiring valid encryption keys."},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-11-07","epss":0.01104,"percentile":0.65973}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"9596d540aa4016c7","cpes":["cpe:2.3:a:redhat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-2.el8_10.2?arch=x86_64&distro=rhel-8.10&upstream=expat-2.5.0-2.el8_10.2.src.rpm","type":"rpm","version":"2.5.0-2.el8_10.2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.5.0-4.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-66046","versionConstraint":"< 0:2.5.0-4.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"expat","version":"0:2.5.0-2.el8_10.2"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-66046","fix":{"state":"fixed","versions":["0:2.5.0-4.el8_10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"0:2.5.0-4.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66046","date":"2026-11-07","epss":0.00742,"percentile":0.54919}],"risk":0.5565,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:72448","link":"https://access.redhat.com/errata/RHSA-2026:72448"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-66046","description":"A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts() function, causing excessive CPU consumption and a denial of service"},"relatedVulnerabilities":[{"id":"CVE-2026-66046","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66046","date":"2026-11-07","epss":0.00742,"percentile":0.54919}],"urls":["https://github.com/libexpat/libexpat/pull/1321","https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66046","description":"Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options."}]},{"artifact":{"id":"14f406c5bcf8faf4","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.7?arch=x86_64&distro=rhel-8.10&upstream=libxml2-2.9.7-21.el8_10.7.src.rpm","type":"rpm","version":"2.9.7-21.el8_10.7","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.9.7-21.el8_10.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-74860","versionConstraint":"< 0:2.9.7-21.el8_10.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libxml2","version":"0:2.9.7-21.el8_10.7"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-74860","fix":{"state":"fixed","versions":["0:2.9.7-21.el8_10.9"],"available":[{"date":"2026-09-25","kind":"first-observed","version":"0:2.9.7-21.el8_10.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74860","cwe":"CWE-763","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-74860","date":"2026-11-07","epss":0.00658,"percentile":0.51727}],"risk":0.5264000000000001,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:71641","link":"https://access.redhat.com/errata/RHSA-2026:71641"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings."},"relatedVulnerabilities":[{"id":"CVE-2026-74860","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74860","cwe":"CWE-763","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-74860","date":"2026-11-07","epss":0.00658,"percentile":0.51727}],"urls":["https://access.redhat.com/errata/RHSA-2026:64463","https://access.redhat.com/errata/RHSA-2026:71585","https://access.redhat.com/errata/RHSA-2026:71586","https://access.redhat.com/errata/RHSA-2026:71641","https://access.redhat.com/errata/RHSA-2026:72470","https://access.redhat.com/errata/RHSA-2026:72475","https://access.redhat.com/errata/RHSA-2026:72476","https://access.redhat.com/errata/RHSA-2026:79357","https://access.redhat.com/errata/RHSA-2026:82939","https://access.redhat.com/errata/RHSA-2026:89750","https://access.redhat.com/errata/RHSA-2026:89759","https://access.redhat.com/errata/RHSA-2026:90309","https://access.redhat.com/errata/RHSA-2026:91202","https://access.redhat.com/errata/RHSA-2026:91204","https://access.redhat.com/errata/RHSA-2026:91206","https://access.redhat.com/errata/RHSA-2026:91207","https://access.redhat.com/errata/RHSA-2026:91217","https://access.redhat.com/errata/RHSA-2026:91218","https://access.redhat.com/errata/RHSA-2026:91219","https://access.redhat.com/errata/RHSA-2026:91224","https://access.redhat.com/errata/RHSA-2026:91232","https://access.redhat.com/errata/RHSA-2026:91233","https://access.redhat.com/errata/RHSA-2026:91234","https://access.redhat.com/errata/RHSA-2026:91235","https://access.redhat.com/errata/RHSA-2026:91236","https://access.redhat.com/errata/RHSA-2026:91237","https://access.redhat.com/errata/RHSA-2026:91238","https://access.redhat.com/errata/RHSA-2026:91241","https://access.redhat.com/errata/RHSA-2026:91242","https://access.redhat.com/errata/RHSA-2026:91243","https://access.redhat.com/errata/RHSA-2026:91244","https://access.redhat.com/errata/RHSA-2026:91245","https://access.redhat.com/errata/RHSA-2026:91246","https://access.redhat.com/errata/RHSA-2026:91248","https://access.redhat.com/errata/RHSA-2026:91249","https://access.redhat.com/errata/RHSA-2026:92352","https://access.redhat.com/errata/RHSA-2026:92589","https://access.redhat.com/errata/RHSA-2026:93463","https://access.redhat.com/errata/RHSA-2026:93473","https://access.redhat.com/errata/RHSA-2026:93791","https://access.redhat.com/errata/RHSA-2026:94459","https://access.redhat.com/errata/RHSA-2026:94468","https://access.redhat.com/errata/RHSA-2026:94474","https://access.redhat.com/errata/RHSA-2026:94476","https://access.redhat.com/security/cve/CVE-2026-74860","https://bugzilla.redhat.com/show_bug.cgi?id=2529697"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings."}]},{"artifact":{"id":"93eed475e569196b","cpes":["cpe:2.3:a:platform-python-pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python-pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"platform-python-pip","purl":"pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-47081","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-47081","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47081","cwe":"CWE-522","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47081","date":"2026-11-07","epss":0.01022,"percentile":0.63683}],"risk":0.5263300000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-47081","description":"A flaw was found in the Requests HTTP library. This vulnerability allows leakage of .netrc credentials to third parties via maliciously crafted URLs that exploit a URL parsing issue."},"relatedVulnerabilities":[{"id":"CVE-2024-47081","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47081","cwe":"CWE-522","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47081","date":"2026-11-07","epss":0.01022,"percentile":0.63683}],"urls":["https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef","https://github.com/psf/requests/pull/6965","https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7","https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env","https://seclists.org/fulldisclosure/2025/Jun/2","http://seclists.org/fulldisclosure/2025/Jun/2","http://www.openwall.com/lists/oss-security/2025/06/03/11","http://www.openwall.com/lists/oss-security/2025/06/03/9","http://www.openwall.com/lists/oss-security/2025/06/04/1","http://www.openwall.com/lists/oss-security/2025/06/04/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081","description":"Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session."}]},{"artifact":{"id":"fa83cdeeda4e9e6a","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-47081","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-47081","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47081","cwe":"CWE-522","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47081","date":"2026-11-07","epss":0.01022,"percentile":0.63683}],"risk":0.5263300000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-47081","description":"A flaw was found in the Requests HTTP library. This vulnerability allows leakage of .netrc credentials to third parties via maliciously crafted URLs that exploit a URL parsing issue."},"relatedVulnerabilities":[{"id":"CVE-2024-47081","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47081","cwe":"CWE-522","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-47081","date":"2026-11-07","epss":0.01022,"percentile":0.63683}],"urls":["https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef","https://github.com/psf/requests/pull/6965","https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7","https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env","https://seclists.org/fulldisclosure/2025/Jun/2","http://seclists.org/fulldisclosure/2025/Jun/2","http://www.openwall.com/lists/oss-security/2025/06/03/11","http://www.openwall.com/lists/oss-security/2025/06/03/9","http://www.openwall.com/lists/oss-security/2025/06/04/1","http://www.openwall.com/lists/oss-security/2025/06/04/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081","description":"Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session."}]},{"artifact":{"id":"14f406c5bcf8faf4","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.7?arch=x86_64&distro=rhel-8.10&upstream=libxml2-2.9.7-21.el8_10.7.src.rpm","type":"rpm","version":"2.9.7-21.el8_10.7","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0990","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libxml2","version":"0:2.9.7-21.el8_10.7"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0990","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0990","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0990","date":"2026-11-07","epss":0.00955,"percentile":0.61607}],"risk":0.520475,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0990","description":"A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications."},"relatedVulnerabilities":[{"id":"CVE-2026-0990","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0990","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0990","date":"2026-11-07","epss":0.00955,"percentile":0.61607}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0990","https://bugzilla.redhat.com/show_bug.cgi?id=2429959","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0990","description":"A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications."}]},{"artifact":{"id":"8d28acbe9944600a","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-07","epss":0.01037,"percentile":0.64119}],"risk":0.49257500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-50495","description":"A vulnerability was found in the NCurses package, where a segmentation fault may be triggered through _nc_wrap_entry()."},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-07","epss":0.01037,"percentile":0.64119}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"740497c732ce2972","cpes":["cpe:2.3:a:ncurses-libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-libs","purl":"pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-07","epss":0.01037,"percentile":0.64119}],"risk":0.49257500000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-50495","description":"A vulnerability was found in the NCurses package, where a segmentation fault may be triggered through _nc_wrap_entry()."},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-07","epss":0.01037,"percentile":0.64119}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"8fc7beeea7c060aa","cpes":["cpe:2.3:a:org.eclipse.jetty.http:jetty-http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:jetty_http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty-http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty_http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty-http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty_http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:jetty:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty-http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.http:http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty-http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty_http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty-http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty_http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:jetty:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:jetty:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty-http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty_http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty-http:http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty_http:http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:http:jetty:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:jetty:http:9.4.63:*:*:*:*:*:*:*","cpe:2.3:a:http:http:9.4.63:*:*:*:*:*:*:*"],"name":"jetty-http","purl":"pkg:maven/org.eclipse.jetty/jetty-http@9.4.63","type":"java-archive","version":"9.4.63","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0, https://www.eclipse.org/org/documents/epl-v10.php"],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/usr/share/java/kafka/jetty-http-9.4.63.jar","manifestName":"","pomArtifactID":"jetty-http","archiveDigests":[{"value":"e1e5a3b00752520d61f857460a20e03c53de6380","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/jetty-http-9.4.63.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jetty-http-9.4.63.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"12.0.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qh8g-58pp-2wxh","versionConstraint":">=7.0.0,<=12.0.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-http","version":"9.4.63"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qh8g-58pp-2wxh","fix":{"state":"fixed","versions":["12.0.12"],"available":[{"date":"2024-10-15","kind":"first-observed","version":"12.0.12"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6763","cwe":"CWE-1286","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2024-6763","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6763","date":"2026-11-07","epss":0.00965,"percentile":0.61903}],"risk":0.48250000000000004,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh","https://nvd.nist.gov/vuln/detail/CVE-2024-6763","https://github.com/jetty/jetty.project/pull/12012","https://gitlab.eclipse.org/security/cve-assignement/-/issues/25","https://security.netapp.com/advisory/ntap-20250306-0005"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qh8g-58pp-2wxh","description":"Eclipse Jetty URI parsing of invalid authority"},"relatedVulnerabilities":[{"id":"CVE-2024-6763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-6763","cwe":"CWE-1286","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2024-6763","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-6763","date":"2026-11-07","epss":0.00965,"percentile":0.61903}],"urls":["https://github.com/jetty/jetty.project/pull/12012","https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh","https://gitlab.eclipse.org/security/cve-assignement/-/issues/25","https://security.netapp.com/advisory/ntap-20250306-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6763","description":"Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC.  Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-41996","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-41996","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-11-07","epss":0.01083,"percentile":0.65383}],"risk":0.481935,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-41996","description":"A vulnerability was found in the Diffie-Hellman Ephemeral (DHE) Key Agreement Protocol, where a malicious client can exploit the server's public key validation process. By forcing the server to use DHE and validating the order of public keys, the client can trigger expensive server-side modular exponentiation calculations. This issue results in asymmetric resource consumption, potentially leading to a denial of service (DoS) attack by overwhelming the server with computationally intensive operations."},"relatedVulnerabilities":[{"id":"CVE-2024-41996","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-11-07","epss":0.01083,"percentile":0.65383}],"urls":["https://dheatattack.gitlab.io/details/","https://dheatattack.gitlab.io/faq/","https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-41996","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-41996","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-41996","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-11-07","epss":0.01083,"percentile":0.65383}],"risk":0.481935,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-41996","description":"A vulnerability was found in the Diffie-Hellman Ephemeral (DHE) Key Agreement Protocol, where a malicious client can exploit the server's public key validation process. By forcing the server to use DHE and validating the order of public keys, the client can trigger expensive server-side modular exponentiation calculations. This issue results in asymmetric resource consumption, potentially leading to a denial of service (DoS) attack by overwhelming the server with computationally intensive operations."},"relatedVulnerabilities":[{"id":"CVE-2024-41996","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-41996","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-41996","date":"2026-11-07","epss":0.01083,"percentile":0.65383}],"urls":["https://dheatattack.gitlab.io/details/","https://dheatattack.gitlab.io/faq/","https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-41996","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key."}]},{"artifact":{"id":"c0992ee9cbf195f6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-07","epss":0.00628,"percentile":0.50351}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-07","epss":0.00628,"percentile":0.50351}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ff25387491f3ba91","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.14.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-07","epss":0.00628,"percentile":0.50351}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-11-07","epss":0.00628,"percentile":0.50351}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"a188d60050103aa1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/cp-base-new/jackson-core-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0ca645ad40f7be06d1a0bbdf9f363d3838b41f40","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/jackson-core-2.18.9.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/jackson-core-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.17.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-11-07","epss":0.00628,"percentile":0.50344}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-11-07","epss":0.00628,"percentile":0.50344}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"f09d77d776916a2f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/kafka/jackson-core-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0ca645ad40f7be06d1a0bbdf9f363d3838b41f40","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/jackson-core-2.18.9.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jackson-core-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.17.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-11-07","epss":0.00628,"percentile":0.50344}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-11-07","epss":0.00628,"percentile":0.50344}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"3fa5e9a1b5f18fed","cpes":["cpe:2.3:a:redhat:pcre2:10.32-3.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.32-3.el8_6:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=rhel-8.10&upstream=pcre2-10.32-3.el8_6.src.rpm","type":"rpm","version":"10.32-3.el8_6","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-41409","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"pcre2","version":"0:10.32-3.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2022-41409","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-11-07","epss":0.01121,"percentile":0.66386}],"risk":0.465215,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-41409","description":"A flaw was found in PCRE2, where it is susceptible to an integer overflow vulnerability triggered by a negative repeat value in the pcre2test subject line that causes infinite looping. This flaw allows a remote attacker to pass specially crafted data to the application, initiating an integer overflow and executing a denial of service (DoS) attack."},"relatedVulnerabilities":[{"id":"CVE-2022-41409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-11-07","epss":0.01121,"percentile":0.66386}],"urls":["https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35","https://github.com/PCRE2Project/pcre2/issues/141"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41409","description":"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input."}]},{"artifact":{"id":"55281a0c21c596b7","cpes":["cpe:2.3:a:redhat:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=rhel-8.10&epoch=2&upstream=tar-1.30-11.el8_10.src.rpm","type":"rpm","version":"2:1.30-11.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-20193","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"tar","version":"2:1.30-11.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2021-20193","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20193","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-20193","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-20193","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-20193","date":"2026-11-07","epss":0.01096,"percentile":0.65762}],"risk":0.4548399999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-20193","description":"A flaw was found in the src/list.c of tar. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2021-20193","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20193","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-20193","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-20193","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-20193","date":"2026-11-07","epss":0.01096,"percentile":0.65762}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1917565","https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777","https://savannah.gnu.org/bugs/?59897","https://security.gentoo.org/glsa/202105-29","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-20193","description":"A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"f3dbf2601d631118","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.14.3-32.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-07","epss":0.00701,"percentile":0.53447}],"risk":0.44864,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-07","epss":0.00701,"percentile":0.53447}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"6c723629f01508b1","cpes":["cpe:2.3:a:redhat:rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"0:4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-07","epss":0.00701,"percentile":0.53447}],"risk":0.44864,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-07","epss":0.00701,"percentile":0.53447}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"e44a5dd2f875a462","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.14.3-32.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-07","epss":0.00701,"percentile":0.53447}],"risk":0.44864,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-07","epss":0.00701,"percentile":0.53447}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"9c24e9e6f2be9987","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.14.3-32.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-84837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-07","epss":0.00701,"percentile":0.53447}],"risk":0.44864,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."},"relatedVulnerabilities":[{"id":"CVE-2026-84837","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84837","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84837","date":"2026-11-07","epss":0.00701,"percentile":0.53447}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-84837","https://bugzilla.redhat.com/show_bug.cgi?id=2478408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84837","description":"A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-69421","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-69421","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-11-07","epss":0.00944,"percentile":0.61286}],"risk":0.4484,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69421","description":"A flaw was found in OpenSSL. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by providing a specially crafted, malformed PKCS#12 file to an application that processes it. The flaw occurs due to a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function when handling the malformed file, leading to an application crash."},"relatedVulnerabilities":[{"id":"CVE-2025-69421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-11-07","epss":0.00944,"percentile":0.61286}],"urls":["https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b","https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7","https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd","https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3","https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69421","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-69421","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-11-07","epss":0.00944,"percentile":0.61286}],"risk":0.4484,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69421","description":"A flaw was found in OpenSSL. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by providing a specially crafted, malformed PKCS#12 file to an application that processes it. The flaw occurs due to a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function when handling the malformed file, leading to an application crash."},"relatedVulnerabilities":[{"id":"CVE-2025-69421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-11-07","epss":0.00944,"percentile":0.61286}],"urls":["https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b","https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7","https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd","https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3","https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}]},{"artifact":{"id":"d6198730eb90fd58","cpes":["cpe:2.3:a:jline-remote-telnet:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-remote-telnet:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_remote_telnet:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_remote_telnet:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-remote:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-remote:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_remote:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_remote:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*"],"name":"jline-remote-telnet","purl":"pkg:maven/org.jline/jline-remote-telnet@3.25.1","type":"java-archive","version":"3.25.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.jline","virtualPath":"/usr/share/java/kafka/jline-3.25.1.jar:org.jline:jline-remote-telnet","manifestName":"","pomArtifactID":"jline-remote-telnet","archiveDigests":null},"locations":[{"path":"/usr/share/java/kafka/jline-3.25.1.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jline-3.25.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.30.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2r2c-cx56-8933","versionConstraint":"<3.30.14 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jline:jline-remote-telnet","version":"3.25.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2r2c-cx56-8933","fix":{"state":"fixed","versions":["3.30.14"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"3.30.14"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56741","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56741","date":"2026-11-07","epss":0.00595,"percentile":0.48703}],"risk":0.44625000000000004,"urls":["https://github.com/jline/jline3/security/advisories/GHSA-2r2c-cx56-8933","https://nvd.nist.gov/vuln/detail/CVE-2026-56741","https://github.com/jline/jline3/pull/2000","https://github.com/jline/jline3/commit/3ea9cad8699714dc072fade29d36be0d1e23d708","https://github.com/jline/jline3/commit/733eb353dca7b0ea0252e724445b6defa29c393e","https://github.com/jline/jline3/commit/86b7ba7801988aadb1a67555629522a71d603bd3","https://github.com/jline/jline3/releases/tag/4.0.16","https://github.com/jline/jline3/releases/tag/4.2.1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2r2c-cx56-8933","description":"JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry"},"relatedVulnerabilities":[{"id":"CVE-2026-56741","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56741","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56741","date":"2026-11-07","epss":0.00595,"percentile":0.48703}],"urls":["https://github.com/jline/jline3/commit/3ea9cad8699714dc072fade29d36be0d1e23d708","https://github.com/jline/jline3/commit/733eb353dca7b0ea0252e724445b6defa29c393e","https://github.com/jline/jline3/commit/86b7ba7801988aadb1a67555629522a71d603bd3","https://github.com/jline/jline3/pull/2000","https://github.com/jline/jline3/releases/tag/4.0.16","https://github.com/jline/jline3/releases/tag/4.2.1","https://github.com/jline/jline3/security/advisories/GHSA-2r2c-cx56-8933"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56741","description":"JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1."}]},{"artifact":{"id":"2dd3466fcbd5ba1b","cpes":["cpe:2.3:a:jline-builtins:jline-builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:jline_builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline-builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline_builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline-builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline_builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline-builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline_builtins:3.25.1:*:*:*:*:*:*:*"],"name":"jline-builtins","purl":"pkg:maven/org.jline/jline-builtins@3.25.1","type":"java-archive","version":"3.25.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.jline","virtualPath":"/usr/share/java/kafka/jline-3.25.1.jar:org.jline:jline-builtins","manifestName":"","pomArtifactID":"jline-builtins","archiveDigests":null},"locations":[{"path":"/usr/share/java/kafka/jline-3.25.1.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jline-3.25.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.30.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r2xf-8xr9-62gw","versionConstraint":">=3.0.0,<3.30.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jline:jline-builtins","version":"3.25.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r2xf-8xr9-62gw","fix":{"state":"fixed","versions":["3.30.15"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"3.30.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77422","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77422","date":"2026-11-07","epss":0.00595,"percentile":0.48661}],"risk":0.44625000000000004,"urls":["https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r2xf-8xr9-62gw","description":"JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping"},"relatedVulnerabilities":[{"id":"CVE-2026-77422","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77422","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77422","date":"2026-11-07","epss":0.00595,"percentile":0.48661}],"urls":["https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77422","description":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1."}]},{"artifact":{"id":"d6198730eb90fd58","cpes":["cpe:2.3:a:jline-remote-telnet:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-remote-telnet:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_remote_telnet:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_remote_telnet:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-remote:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-remote:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_remote:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_remote:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline-remote-telnet:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline_remote_telnet:3.25.1:*:*:*:*:*:*:*"],"name":"jline-remote-telnet","purl":"pkg:maven/org.jline/jline-remote-telnet@3.25.1","type":"java-archive","version":"3.25.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.jline","virtualPath":"/usr/share/java/kafka/jline-3.25.1.jar:org.jline:jline-remote-telnet","manifestName":"","pomArtifactID":"jline-remote-telnet","archiveDigests":null},"locations":[{"path":"/usr/share/java/kafka/jline-3.25.1.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jline-3.25.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.30.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-47qp-hqvx-6r3f","versionConstraint":"<3.30.14 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jline:jline-remote-telnet","version":"3.25.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-47qp-hqvx-6r3f","fix":{"state":"fixed","versions":["3.30.14"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"3.30.14"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56740","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56740","date":"2026-11-07","epss":0.00592,"percentile":0.48553}],"risk":0.44399999999999995,"urls":["https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f","https://nvd.nist.gov/vuln/detail/CVE-2026-56740","https://github.com/jline/jline3/pull/2000","https://github.com/jline/jline3/pull/2001","https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09","https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40","https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b","https://github.com/jline/jline3/releases/tag/4.0.16","https://github.com/jline/jline3/releases/tag/4.2.1","https://github.com/jline/jline3/releases/tag/jline-3.30.14"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-47qp-hqvx-6r3f","description":"JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables"},"relatedVulnerabilities":[{"id":"CVE-2026-56740","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56740","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56740","date":"2026-11-07","epss":0.00592,"percentile":0.48553}],"urls":["https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09","https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40","https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b","https://github.com/jline/jline3/pull/2000","https://github.com/jline/jline3/pull/2001","https://github.com/jline/jline3/releases/tag/4.0.16","https://github.com/jline/jline3/releases/tag/4.2.1","https://github.com/jline/jline3/releases/tag/jline-3.30.14","https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56740","description":"JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-07","epss":0.00859,"percentile":0.58704}],"risk":0.44238500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-12781","description":"A flaw was found in the base64 module in the Python standard library. The b64decode, standard_b64decode and urlsafe_b64decode functions will always accept the '+' and '/' characters even when an alternative base64 alphabet is specified via the altchars parameter that excludes them. This input validation bypass allows malformed or unexpected data to pass through decoding filters, potentially causing logical errors or data integrity issues in applications relying on strict character sets."},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-07","epss":0.00859,"percentile":0.58704}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-07","epss":0.00859,"percentile":0.58704}],"risk":0.44238500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-12781","description":"A flaw was found in the base64 module in the Python standard library. The b64decode, standard_b64decode and urlsafe_b64decode functions will always accept the '+' and '/' characters even when an alternative base64 alphabet is specified via the altchars parameter that excludes them. This input validation bypass allows malformed or unexpected data to pass through decoding filters, potentially causing logical errors or data integrity issues in applications relying on strict character sets."},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-07","epss":0.00859,"percentile":0.58704}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42766","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42766","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-11-07","epss":0.0106,"percentile":0.64745}],"risk":0.4399,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42766","description":"A flaw was found in OpenSSL. A remote attacker could exploit a NULL pointer dereference vulnerability in the Cryptographic Message Syntax (CMS) decryption process by providing a specially crafted password-encrypted CMS message. This occurs because the keyDerivationAlgorithm field, which is optional, is dereferenced without proper validation. Successful exploitation leads to an application crash, resulting in a Denial of Service."},"relatedVulnerabilities":[{"id":"CVE-2026-42766","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-11-07","epss":0.0106,"percentile":0.64745}],"urls":["https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce","https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4","https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7","https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4","https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","description":"Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42766","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42766","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-11-07","epss":0.0106,"percentile":0.64745}],"risk":0.4399,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42766","description":"A flaw was found in OpenSSL. A remote attacker could exploit a NULL pointer dereference vulnerability in the Cryptographic Message Syntax (CMS) decryption process by providing a specially crafted password-encrypted CMS message. This occurs because the keyDerivationAlgorithm field, which is optional, is dereferenced without proper validation. Successful exploitation leads to an application crash, resulting in a Denial of Service."},"relatedVulnerabilities":[{"id":"CVE-2026-42766","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-11-07","epss":0.0106,"percentile":0.64745}],"urls":["https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce","https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4","https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7","https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4","https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","description":"Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"14f406c5bcf8faf4","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.7?arch=x86_64&distro=rhel-8.10&upstream=libxml2-2.9.7-21.el8_10.7.src.rpm","type":"rpm","version":"2.9.7-21.el8_10.7","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-45322","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libxml2","version":"0:2.9.7-21.el8_10.7"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-45322","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45322","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-45322","date":"2026-11-07","epss":0.00965,"percentile":0.61902}],"risk":0.4294250000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-45322","description":"A flaw was found in libxml2. In an out-of-memory condition or when limiting the memory allocation, processing a XML document using the HTML parser may result in a use-after-free vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2023-45322","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45322","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-45322","date":"2026-11-07","epss":0.00965,"percentile":0.61902}],"urls":["http://www.openwall.com/lists/oss-security/2023/10/06/5","https://gitlab.gnome.org/GNOME/libxml2/-/issues/344","https://gitlab.gnome.org/GNOME/libxml2/-/issues/583","https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45322","description":"libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\""}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-07","epss":0.00715,"percentile":0.5399}],"risk":0.41112499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11972","description":"A flaw was found in the Python `tarfile` module. When processing a specially crafted tar archive opened in 'streaming mode' (mode='r|'), the module does not properly handle the end-of-file (EOF) condition. This can cause the `tarfile` module to enter an infinite loop, leading to a Denial of Service (DoS) for applications processing such archives."},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-07","epss":0.00715,"percentile":0.5399}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-07","epss":0.00715,"percentile":0.5399}],"risk":0.41112499999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11972","description":"A flaw was found in the Python `tarfile` module. When processing a specially crafted tar archive opened in 'streaming mode' (mode='r|'), the module does not properly handle the end-of-file (EOF) condition. This can cause the `tarfile` module to enter an infinite loop, leading to a Denial of Service (DoS) for applications processing such archives."},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-07","epss":0.00715,"percentile":0.5399}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-34180","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-34180","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-11-07","epss":0.01025,"percentile":0.6379}],"risk":0.41000000000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34180","description":"A flaw was found in OpenSSL. An integer truncation vulnerability in the ASN.1 decoder can occur when processing a crafted DER-encoded ASN.1 structure with a primitive element exceeding 2 gigabytes. A remote attacker could exploit this to cause a heap buffer over-read. This may lead to an application crash, resulting in a Denial of Service (DoS), or potentially disclose sensitive information by loading memory contents beyond the input buffer. This issue primarily affects 64-bit Unix and Unix-like platforms."},"relatedVulnerabilities":[{"id":"CVE-2026-34180","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-11-07","epss":0.01025,"percentile":0.6379}],"urls":["https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d","https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83","https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff","https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43","https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","description":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34180","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-34180","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-11-07","epss":0.01025,"percentile":0.6379}],"risk":0.41000000000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34180","description":"A flaw was found in OpenSSL. An integer truncation vulnerability in the ASN.1 decoder can occur when processing a crafted DER-encoded ASN.1 structure with a primitive element exceeding 2 gigabytes. A remote attacker could exploit this to cause a heap buffer over-read. This may lead to an application crash, resulting in a Denial of Service (DoS), or potentially disclose sensitive information by loading memory contents beyond the input buffer. This issue primarily affects 64-bit Unix and Unix-like platforms."},"relatedVulnerabilities":[{"id":"CVE-2026-34180","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-11-07","epss":0.01025,"percentile":0.6379}],"urls":["https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d","https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83","https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff","https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43","https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","description":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-69420","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-69420","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-11-07","epss":0.0092,"percentile":0.60502}],"risk":0.40940000000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69420","description":"A flaw was found in OpenSSL. A type confusion vulnerability exists in the TimeStamp Response verification code, where an ASN1_TYPE union member is accessed without proper type validation. A remote attacker can exploit this by providing a malformed TimeStamp Response to an application that verifies timestamp responses. This can lead to an invalid or NULL pointer dereference, resulting in a Denial of Service (DoS) due to an application crash."},"relatedVulnerabilities":[{"id":"CVE-2025-69420","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-11-07","epss":0.0092,"percentile":0.60502}],"urls":["https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9","https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a","https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e","https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b","https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69420","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-69420","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-11-07","epss":0.0092,"percentile":0.60502}],"risk":0.40940000000000004,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-69420","description":"A flaw was found in OpenSSL. A type confusion vulnerability exists in the TimeStamp Response verification code, where an ASN1_TYPE union member is accessed without proper type validation. A remote attacker can exploit this by providing a malformed TimeStamp Response to an application that verifies timestamp responses. This can lead to an invalid or NULL pointer dereference, resulting in a Denial of Service (DoS) due to an application crash."},"relatedVulnerabilities":[{"id":"CVE-2025-69420","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-11-07","epss":0.0092,"percentile":0.60502}],"urls":["https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9","https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a","https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e","https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b","https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28388","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-07","epss":0.00919,"percentile":0.6048}],"risk":0.40895500000000007,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28388","description":"A flaw was found in OpenSSL. When processing a malformed delta Certificate Revocation List (CRL) that lacks a required CRL Number extension, a NULL pointer dereference can occur. This vulnerability can be exploited by a remote attacker who provides a specially crafted delta CRL to an application that has delta CRL processing enabled, leading to a Denial of Service (DoS) for the application."},"relatedVulnerabilities":[{"id":"CVE-2026-28388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-07","epss":0.00919,"percentile":0.6048}],"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28388","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-07","epss":0.00919,"percentile":0.6048}],"risk":0.40895500000000007,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28388","description":"A flaw was found in OpenSSL. When processing a malformed delta Certificate Revocation List (CRL) that lacks a required CRL Number extension, a NULL pointer dereference can occur. This vulnerability can be exploited by a remote attacker who provides a specially crafted delta CRL to an application that has delta CRL processing enabled, leading to a Denial of Service (DoS) for the application."},"relatedVulnerabilities":[{"id":"CVE-2026-28388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-07","epss":0.00919,"percentile":0.6048}],"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:3.6.8-79.el8_10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"< 0:3.6.8-79.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"fixed","versions":["0:3.6.8-79.el8_10"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:3.6.8-79.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-07","epss":0.00524,"percentile":0.44727}],"risk":0.40872,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:85239","link":"https://access.redhat.com/errata/RHSA-2026:85239"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19445","description":"A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.sni_callback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the server process or result in a call through a freed pointer. Servers that wrap their listening socket with a long-lived SSLContext are not affected. TLS clients are not affected."},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-07","epss":0.00524,"percentile":0.44727}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:3.6.8-79.el8_10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"< 0:3.6.8-79.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"fixed","versions":["0:3.6.8-79.el8_10"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:3.6.8-79.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-07","epss":0.00524,"percentile":0.44727}],"risk":0.40872,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:85239","link":"https://access.redhat.com/errata/RHSA-2026:85239"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19445","description":"A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.sni_callback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the server process or result in a call through a freed pointer. Servers that wrap their listening socket with a long-lived SSLContext are not affected. TLS clients are not affected."},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-07","epss":0.00524,"percentile":0.44727}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:3.6.8-79.el8_10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"< 0:3.6.8-79.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"fixed","versions":["0:3.6.8-79.el8_10"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:3.6.8-79.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-07","epss":0.00547,"percentile":0.46045}],"risk":0.40751499999999996,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:85239","link":"https://access.redhat.com/errata/RHSA-2026:85239"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19553","description":"A flaw was found in Python. When establishing secure connections using the SSLContext.wrap_bio() function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rather than triggering an error. A remote man-in-the-middle attacker could exploit this defect to spoof trusted endpoints and intercept or tamper with sensitive encrypted traffic."},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-07","epss":0.00547,"percentile":0.46045}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:3.6.8-79.el8_10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"< 0:3.6.8-79.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"fixed","versions":["0:3.6.8-79.el8_10"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:3.6.8-79.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-07","epss":0.00547,"percentile":0.46045}],"risk":0.40751499999999996,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:85239","link":"https://access.redhat.com/errata/RHSA-2026:85239"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19553","description":"A flaw was found in Python. When establishing secure connections using the SSLContext.wrap_bio() function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rather than triggering an error. A remote man-in-the-middle attacker could exploit this defect to spoof trusted endpoints and intercept or tamper with sensitive encrypted traffic."},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-07","epss":0.00547,"percentile":0.46045}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9546","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-9546","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-11-07","epss":0.00652,"percentile":0.51504}],"risk":0.4075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9546","description":"A flaw was found in libcurl. This vulnerability causes the HTTP Referer header to persist even after it has been explicitly cleared. This can lead to the previous referrer string being unintentionally reused and sent in subsequent requests, potentially disclosing sensitive information to unintended servers."},"relatedVulnerabilities":[{"id":"CVE-2026-9546","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-11-07","epss":0.00652,"percentile":0.51504}],"urls":["https://curl.se/docs/CVE-2026-9546.html","https://curl.se/docs/CVE-2026-9546.json","https://hackerone.com/reports/3754343"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9546","description":"A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9546","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-9546","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-11-07","epss":0.00652,"percentile":0.51504}],"risk":0.4075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9546","description":"A flaw was found in libcurl. This vulnerability causes the HTTP Referer header to persist even after it has been explicitly cleared. This can lead to the previous referrer string being unintentionally reused and sent in subsequent requests, potentially disclosing sensitive information to unintended servers."},"relatedVulnerabilities":[{"id":"CVE-2026-9546","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9546","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9546","date":"2026-11-07","epss":0.00652,"percentile":0.51504}],"urls":["https://curl.se/docs/CVE-2026-9546.html","https://curl.se/docs/CVE-2026-9546.json","https://hackerone.com/reports/3754343"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9546","description":"A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers."}]},{"artifact":{"id":"9f1348c074e62048","cpes":["cpe:2.3:a:libgcc:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2022-27943","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-07","epss":0.00953,"percentile":0.61553}],"risk":0.4050250000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-27943","description":"A flaw was found in binutils, where GNU GCC is vulnerable to a denial of service caused by a stack consumption in the demangle_const() function in libiberty/rust-demangle.c. The vulnerability exists due to the application not properly controlling the consumption of internal resources. By persuading a victim to open a specially-crafted file, an attacker could cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-27943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-07","epss":0.00953,"percentile":0.61553}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."}]},{"artifact":{"id":"18d5838298e1194f","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2022-27943","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-07","epss":0.00953,"percentile":0.61553}],"risk":0.4050250000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-27943","description":"A flaw was found in binutils, where GNU GCC is vulnerable to a denial of service caused by a stack consumption in the demangle_const() function in libiberty/rust-demangle.c. The vulnerability exists due to the application not properly controlling the consumption of internal resources. By persuading a victim to open a specially-crafted file, an attacker could cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-27943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-07","epss":0.00953,"percentile":0.61553}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-07","epss":0.00699,"percentile":0.53383}],"risk":0.4019249999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92388","description":"A flaw was found in curl. A remote malicious server can cause a Denial of Service (DoS) or memory corruption in applications that enable File Transfer Protocol (FTP) wildcard matching. When a wildcard listing operation fails, curl does not properly reset its internal callback handlers before the connection handle is reused or duplicated. An application that subsequently reuses or clones this corrupted handle may experience an immediate application crash or unsafe memory access."},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-07","epss":0.00699,"percentile":0.53383}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-07","epss":0.00699,"percentile":0.53383}],"risk":0.4019249999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92388","description":"A flaw was found in curl. A remote malicious server can cause a Denial of Service (DoS) or memory corruption in applications that enable File Transfer Protocol (FTP) wildcard matching. When a wildcard listing operation fails, curl does not properly reset its internal callback handlers before the connection handle is reused or duplicated. An application that subsequently reuses or clones this corrupted handle may experience an immediate application crash or unsafe memory access."},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-07","epss":0.00699,"percentile":0.53383}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"f09d77d776916a2f","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/kafka/jackson-core-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0ca645ad40f7be06d1a0bbdf9f363d3838b41f40","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/jackson-core-2.18.9.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jackson-core-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-07","epss":0.00532,"percentile":0.45214}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-07","epss":0.00532,"percentile":0.45214}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"a188d60050103aa1","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/cp-base-new/jackson-core-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"0ca645ad40f7be06d1a0bbdf9f363d3838b41f40","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/jackson-core-2.18.9.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/jackson-core-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.8.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-07","epss":0.00532,"percentile":0.45214}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-11-07","epss":0.00532,"percentile":0.45214}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:7.61.1-34.el8_10.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11856","versionConstraint":"< 0:7.61.1-34.el8_10.18 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-11856","fix":{"state":"fixed","versions":["0:7.61.1-34.el8_10.18"],"available":[{"date":"2026-10-30","kind":"first-observed","version":"0:7.61.1-34.el8_10.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-11-07","epss":0.00688,"percentile":0.52944}],"risk":0.39559999999999995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92368","link":"https://access.redhat.com/errata/RHSA-2026:92368"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11856","description":"A flaw was found in curl. When `libcurl` performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2026-11856","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-11-07","epss":0.00688,"percentile":0.52944}],"urls":["https://curl.se/docs/CVE-2026-11856.html","https://curl.se/docs/CVE-2026-11856.json","https://hackerone.com/reports/3793260"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:7.61.1-34.el8_10.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11856","versionConstraint":"< 0:7.61.1-34.el8_10.18 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-11856","fix":{"state":"fixed","versions":["0:7.61.1-34.el8_10.18"],"available":[{"date":"2026-10-30","kind":"first-observed","version":"0:7.61.1-34.el8_10.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-11-07","epss":0.00688,"percentile":0.52944}],"risk":0.39559999999999995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92368","link":"https://access.redhat.com/errata/RHSA-2026:92368"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11856","description":"A flaw was found in curl. When `libcurl` performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2026-11856","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-11-07","epss":0.00688,"percentile":0.52944}],"urls":["https://curl.se/docs/CVE-2026-11856.html","https://curl.se/docs/CVE-2026-11856.json","https://hackerone.com/reports/3793260"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4224","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4224","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-07","epss":0.00717,"percentile":0.5407}],"risk":0.39076500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4224","description":"A stack overflow flaw has been discovered in the python pyexpat module. When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. This will result in a program crash."},"relatedVulnerabilities":[{"id":"CVE-2026-4224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-07","epss":0.00717,"percentile":0.5407}],"urls":["https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a","https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621","https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785","https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee","https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3","https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768","https://github.com/python/cpython/issues/145986","https://github.com/python/cpython/pull/145987","https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/","http://www.openwall.com/lists/oss-security/2026/03/16/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224","description":"When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4224","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4224","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-07","epss":0.00717,"percentile":0.5407}],"risk":0.39076500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4224","description":"A stack overflow flaw has been discovered in the python pyexpat module. When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. This will result in a program crash."},"relatedVulnerabilities":[{"id":"CVE-2026-4224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4224","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4224","date":"2026-11-07","epss":0.00717,"percentile":0.5407}],"urls":["https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a","https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621","https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785","https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee","https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3","https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768","https://github.com/python/cpython/issues/145986","https://github.com/python/cpython/pull/145987","https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/","http://www.openwall.com/lists/oss-security/2026/03/16/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224","description":"When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-07","epss":0.01166,"percentile":0.67505}],"risk":0.39060999999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92391","description":"A flaw was found in curl. An attacker could supply deeply nested Multipurpose Internet Mail Extensions (MIME) structures to an application utilizing the libcurl library. During memory cleanup in the curl_mime_free function, excessive recursive calls exhaust available stack memory, leading to an application crash and a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-07","epss":0.01166,"percentile":0.67505}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-07","epss":0.01166,"percentile":0.67505}],"risk":0.39060999999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92391","description":"A flaw was found in curl. An attacker could supply deeply nested Multipurpose Internet Mail Extensions (MIME) structures to an application utilizing the libcurl library. During memory cleanup in the curl_mime_free function, excessive recursive calls exhaust available stack memory, leading to an application crash and a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-07","epss":0.01166,"percentile":0.67505}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:7.61.1-34.el8_10.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8924","versionConstraint":"< 0:7.61.1-34.el8_10.18 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-8924","fix":{"state":"fixed","versions":["0:7.61.1-34.el8_10.18"],"available":[{"date":"2026-10-30","kind":"first-observed","version":"0:7.61.1-34.el8_10.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-11-07","epss":0.00661,"percentile":0.51853}],"risk":0.380075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92368","link":"https://access.redhat.com/errata/RHSA-2026:92368"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8924","description":"A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-8924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-11-07","epss":0.00661,"percentile":0.51853}],"urls":["https://curl.se/docs/CVE-2026-8924.html","https://curl.se/docs/CVE-2026-8924.json","https://hackerone.com/reports/3733905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:7.61.1-34.el8_10.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8924","versionConstraint":"< 0:7.61.1-34.el8_10.18 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-8924","fix":{"state":"fixed","versions":["0:7.61.1-34.el8_10.18"],"available":[{"date":"2026-10-30","kind":"first-observed","version":"0:7.61.1-34.el8_10.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-11-07","epss":0.00661,"percentile":0.51853}],"risk":0.380075,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92368","link":"https://access.redhat.com/errata/RHSA-2026:92368"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8924","description":"A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-8924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-11-07","epss":0.00661,"percentile":0.51853}],"urls":["https://curl.se/docs/CVE-2026-8924.html","https://curl.se/docs/CVE-2026-8924.json","https://hackerone.com/reports/3733905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains."}]},{"artifact":{"id":"c0992ee9cbf195f6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-07","epss":0.00717,"percentile":0.54055}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-07","epss":0.00717,"percentile":0.54055}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"ff25387491f3ba91","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.11.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-07","epss":0.00717,"percentile":0.54055}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-11-07","epss":0.00717,"percentile":0.54055}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:7.61.1-34.el8_10.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8927","versionConstraint":"< 0:7.61.1-34.el8_10.18 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-8927","fix":{"state":"fixed","versions":["0:7.61.1-34.el8_10.18"],"available":[{"date":"2026-10-30","kind":"first-observed","version":"0:7.61.1-34.el8_10.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-11-07","epss":0.005,"percentile":0.43136}],"risk":0.375,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92368","link":"https://access.redhat.com/errata/RHSA-2026:92368"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8927","description":"A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of `Proxy-Authorization` headers to an incorrect proxy, potentially exposing sensitive authentication information to an unauthorized entity. This is an information disclosure vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2026-8927","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-11-07","epss":0.005,"percentile":0.43136}],"urls":["https://curl.se/docs/CVE-2026-8927.html","https://curl.se/docs/CVE-2026-8927.json","https://hackerone.com/reports/3744543"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:7.61.1-34.el8_10.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8927","versionConstraint":"< 0:7.61.1-34.el8_10.18 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-8927","fix":{"state":"fixed","versions":["0:7.61.1-34.el8_10.18"],"available":[{"date":"2026-10-30","kind":"first-observed","version":"0:7.61.1-34.el8_10.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-11-07","epss":0.005,"percentile":0.43136}],"risk":0.375,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92368","link":"https://access.redhat.com/errata/RHSA-2026:92368"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8927","description":"A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of `Proxy-Authorization` headers to an incorrect proxy, potentially exposing sensitive authentication information to an unauthorized entity. This is an information disclosure vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2026-8927","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-11-07","epss":0.005,"percentile":0.43136}],"urls":["https://curl.se/docs/CVE-2026-8927.html","https://curl.se/docs/CVE-2026-8927.json","https://hackerone.com/reports/3744543"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`."}]},{"artifact":{"id":"5c842fe0f64f5a4c","cpes":["cpe:2.3:a:libssh:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh","purl":"pkg:rpm/redhat/libssh@0.9.6-17.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-3731","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0:0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-3731","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3731","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-3731","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-3731","date":"2026-11-07","epss":0.00724,"percentile":0.54289}],"risk":0.37285999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3731","description":"A flaw was found in libssh. A remote attacker could trigger an out-of-bounds read vulnerability in the SFTP Extension Name Handler by manipulating the `idx` argument in the `sftp_extensions_get_name` or `sftp_extensions_get_data` functions. This could lead to a Denial of Service (DoS), making the affected system unresponsive."},"relatedVulnerabilities":[{"id":"CVE-2026-3731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3731","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-3731","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-3731","date":"2026-11-07","epss":0.00724,"percentile":0.54289}],"urls":["https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60","https://vuldb.com/?ctiid.349709","https://vuldb.com/?id.349709","https://vuldb.com/?submit.767120","https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz","https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3731","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component."}]},{"artifact":{"id":"bd8c4541a903d30b","cpes":["cpe:2.3:a:libssh-config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh-config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh-config","purl":"pkg:rpm/redhat/libssh-config@0.9.6-17.el8_10?arch=noarch&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libssh","version":"0.9.6-17.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3731","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-3731","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3731","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-3731","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-3731","date":"2026-11-07","epss":0.00724,"percentile":0.54289}],"risk":0.37285999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3731","description":"A flaw was found in libssh. A remote attacker could trigger an out-of-bounds read vulnerability in the SFTP Extension Name Handler by manipulating the `idx` argument in the `sftp_extensions_get_name` or `sftp_extensions_get_data` functions. This could lead to a Denial of Service (DoS), making the affected system unresponsive."},"relatedVulnerabilities":[{"id":"CVE-2026-3731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3731","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-3731","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-3731","date":"2026-11-07","epss":0.00724,"percentile":0.54289}],"urls":["https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60","https://vuldb.com/?ctiid.349709","https://vuldb.com/?id.349709","https://vuldb.com/?submit.767120","https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz","https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3731","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component."}]},{"artifact":{"id":"f3dbf2601d631118","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.14.3-32.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-07","epss":0.00582,"percentile":0.48048}],"risk":0.37248,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-07","epss":0.00582,"percentile":0.48048}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"6c723629f01508b1","cpes":["cpe:2.3:a:redhat:rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"0:4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-07","epss":0.00582,"percentile":0.48048}],"risk":0.37248,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-07","epss":0.00582,"percentile":0.48048}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"e44a5dd2f875a462","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.14.3-32.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-07","epss":0.00582,"percentile":0.48048}],"risk":0.37248,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-07","epss":0.00582,"percentile":0.48048}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"9c24e9e6f2be9987","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.14.3-32.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95521","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-95521","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-07","epss":0.00582,"percentile":0.48048}],"risk":0.37248,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."},"relatedVulnerabilities":[{"id":"CVE-2026-95521","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95521","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95521","date":"2026-11-07","epss":0.00582,"percentile":0.48048}],"urls":["https://access.redhat.com/security/cve/CVE-2026-95521","https://bugzilla.redhat.com/show_bug.cgi?id=2537812"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95521","description":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42768","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42768","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42768","cwe":"CWE-514","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42768","date":"2026-11-07","epss":0.00801,"percentile":0.56863}],"risk":0.37246499999999994,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42768","description":"A flaw was found in OpenSSL's CMS_decrypt() and PKCS7_decrypt() functions. This vulnerability, a Bleichenbacher-style oracle, could allow a remote attacker to decrypt or sign messages using the victim's private RSA key. Exploitation requires the attacker to provide specially crafted CMS or S/MIME messages and observe the application's error codes or decryption output. While the attack is technically possible, the specific conditions required make it unlikely to be exploited in typical deployments."},"relatedVulnerabilities":[{"id":"CVE-2026-42768","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42768","cwe":"CWE-514","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42768","date":"2026-11-07","epss":0.00801,"percentile":0.56863}],"urls":["https://github.com/openssl/openssl/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f","https://github.com/openssl/openssl/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d","https://github.com/openssl/openssl/commit/dd68364107a58841c0a2546812518b65d3a23abd","https://github.com/openssl/openssl/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42768","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42768","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42768","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42768","cwe":"CWE-514","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42768","date":"2026-11-07","epss":0.00801,"percentile":0.56863}],"risk":0.37246499999999994,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42768","description":"A flaw was found in OpenSSL's CMS_decrypt() and PKCS7_decrypt() functions. This vulnerability, a Bleichenbacher-style oracle, could allow a remote attacker to decrypt or sign messages using the victim's private RSA key. Exploitation requires the attacker to provide specially crafted CMS or S/MIME messages and observe the application's error codes or decryption output. While the attack is technically possible, the specific conditions required make it unlikely to be exploited in typical deployments."},"relatedVulnerabilities":[{"id":"CVE-2026-42768","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42768","cwe":"CWE-514","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42768","date":"2026-11-07","epss":0.00801,"percentile":0.56863}],"urls":["https://github.com/openssl/openssl/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f","https://github.com/openssl/openssl/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d","https://github.com/openssl/openssl/commit/dd68364107a58841c0a2546812518b65d3a23abd","https://github.com/openssl/openssl/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42768","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-07","epss":0.00836,"percentile":0.57953}],"risk":0.37202,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28389","description":"A flaw was found in OpenSSL. A remote attacker could exploit this by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message with KeyAgreeRecipientInfo. This vulnerability arises because the software attempts to process an optional field without verifying its existence, leading to a NULL pointer dereference. This can result in a Denial of Service (DoS) for applications that handle untrusted CMS data."},"relatedVulnerabilities":[{"id":"CVE-2026-28389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-07","epss":0.00836,"percentile":0.57953}],"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-07","epss":0.00836,"percentile":0.57953}],"risk":0.37202,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28389","description":"A flaw was found in OpenSSL. A remote attacker could exploit this by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message with KeyAgreeRecipientInfo. This vulnerability arises because the software attempts to process an optional field without verifying its existence, leading to a NULL pointer dereference. This can result in a Denial of Service (DoS) for applications that handle untrusted CMS data."},"relatedVulnerabilities":[{"id":"CVE-2026-28389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-07","epss":0.00836,"percentile":0.57953}],"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-07","epss":0.00719,"percentile":0.54148}],"risk":0.37028500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6253","description":"A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-07","epss":0.00719,"percentile":0.54148}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6253","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-07","epss":0.00719,"percentile":0.54148}],"risk":0.37028500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6253","description":"A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6253","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-11-07","epss":0.00719,"percentile":0.54148}],"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"}]},{"artifact":{"id":"2740ea74c614de4e","cpes":["cpe:2.3:a:libevent:libevent:2.1.8-5.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libevent:2.1.8-5.el8:*:*:*:*:*:*:*"],"name":"libevent","purl":"pkg:rpm/redhat/libevent@2.1.8-5.el8?arch=x86_64&distro=rhel-8.10&upstream=libevent-2.1.8-5.el8.src.rpm","type":"rpm","version":"2.1.8-5.el8","language":"","licenses":["BSD and ISC"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.1.8-11.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63383","versionConstraint":"< 0:2.1.8-11.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libevent","version":"0:2.1.8-5.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-63383","fix":{"state":"fixed","versions":["0:2.1.8-11.el8_10"],"available":[{"date":"2026-09-17","kind":"first-observed","version":"0:2.1.8-11.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63383","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63383","date":"2026-11-07","epss":0.00488,"percentile":0.42265}],"risk":0.366,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:67908","link":"https://access.redhat.com/errata/RHSA-2026:67908"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-63383","description":"A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the `decode_tag_internal()` function by sending specially crafted, attacker-controlled tagged RPC (Remote Procedure Call) data. This could lead to a denial of service, causing the process that decodes the data to crash."},"relatedVulnerabilities":[{"id":"CVE-2026-63383","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63383","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63383","date":"2026-11-07","epss":0.00488,"percentile":0.42265}],"urls":["https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321","https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63383","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"2740ea74c614de4e","cpes":["cpe:2.3:a:libevent:libevent:2.1.8-5.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libevent:2.1.8-5.el8:*:*:*:*:*:*:*"],"name":"libevent","purl":"pkg:rpm/redhat/libevent@2.1.8-5.el8?arch=x86_64&distro=rhel-8.10&upstream=libevent-2.1.8-5.el8.src.rpm","type":"rpm","version":"2.1.8-5.el8","language":"","licenses":["BSD and ISC"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.1.8-11.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63384","versionConstraint":"< 0:2.1.8-11.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libevent","version":"0:2.1.8-5.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-63384","fix":{"state":"fixed","versions":["0:2.1.8-11.el8_10"],"available":[{"date":"2026-09-17","kind":"first-observed","version":"0:2.1.8-11.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63384","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63384","date":"2026-11-07","epss":0.00488,"percentile":0.42264}],"risk":0.366,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:67908","link":"https://access.redhat.com/errata/RHSA-2026:67908"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-63384","description":"A flaw was found in Libevent. An incorrect integer conversion in the `evtag_unmarshal_header` function allows a remote attacker to provide a specially crafted payload length. This can lead to a wrapped large allocation request, resulting in a denial of service (DoS) for the affected system."},"relatedVulnerabilities":[{"id":"CVE-2026-63384","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63384","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63384","date":"2026-11-07","epss":0.00488,"percentile":0.42264}],"urls":["https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda","https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63384","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"c0992ee9cbf195f6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-07","epss":0.00487,"percentile":0.4217}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-07","epss":0.00487,"percentile":0.4217}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"ff25387491f3ba91","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.0.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-07","epss":0.00487,"percentile":0.4217}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-11-07","epss":0.00487,"percentile":0.4217}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"ff25387491f3ba91","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-07","epss":0.00487,"percentile":0.42169}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-07","epss":0.00487,"percentile":0.42169}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"c0992ee9cbf195f6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.5.0,<=2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.18.11"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.18.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-07","epss":0.00487,"percentile":0.42169}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-11-07","epss":0.00487,"percentile":0.42169}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15468","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-15468","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15468","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-15468","date":"2026-11-07","epss":0.00819,"percentile":0.57419}],"risk":0.36445500000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15468","description":"A flaw was found in openssl. A remote attacker could trigger a NULL pointer dereference by sending an unknown or unsupported cipher ID during the client hello callback in applications using the QUIC (Quick UDP Internet Connections) protocol. This vulnerability, occurring when the SSL_CIPHER_find() function is called in this specific context, leads to an abnormal termination of the running process, causing a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2025-15468","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15468","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-15468","date":"2026-11-07","epss":0.00819,"percentile":0.57419}],"urls":["https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65","https://github.com/openssl/openssl/commit/7c88376731c589ee5b36116c5a6e32d5ae5f7ae2","https://github.com/openssl/openssl/commit/b2539639400288a4580fe2d76247541b976bade4","https://github.com/openssl/openssl/commit/d75b309879631d45b972396ce4e5102559c64ac7","https://openssl-library.org/news/secadv/20260127.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15468","description":"Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15468","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-15468","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15468","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-15468","date":"2026-11-07","epss":0.00819,"percentile":0.57419}],"risk":0.36445500000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15468","description":"A flaw was found in openssl. A remote attacker could trigger a NULL pointer dereference by sending an unknown or unsupported cipher ID during the client hello callback in applications using the QUIC (Quick UDP Internet Connections) protocol. This vulnerability, occurring when the SSL_CIPHER_find() function is called in this specific context, leads to an abnormal termination of the running process, causing a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2025-15468","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15468","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-15468","date":"2026-11-07","epss":0.00819,"percentile":0.57419}],"urls":["https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65","https://github.com/openssl/openssl/commit/7c88376731c589ee5b36116c5a6e32d5ae5f7ae2","https://github.com/openssl/openssl/commit/b2539639400288a4580fe2d76247541b976bade4","https://github.com/openssl/openssl/commit/d75b309879631d45b972396ce4e5102559c64ac7","https://openssl-library.org/news/secadv/20260127.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15468","description":"Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue."}]},{"artifact":{"id":"c22794ff3ec67fe8","cpes":["cpe:2.3:a:redhat:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.56.4-177.el8_10?arch=x86_64&distro=rhel-8.10&upstream=glib2-2.56.4-177.el8_10.src.rpm","type":"rpm","version":"2.56.4-177.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-32636","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glib2","version":"0:2.56.4-177.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-32636","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32636","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-32636","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-32636","date":"2026-11-07","epss":0.00791,"percentile":0.56526}],"risk":0.36386,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-32636","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499."},"relatedVulnerabilities":[{"id":"CVE-2023-32636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32636","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-32636","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-32636","date":"2026-11-07","epss":0.00791,"percentile":0.56526}],"urls":["https://gitlab.gnome.org/GNOME/glib/-/issues/2841","https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835","https://security.netapp.com/advisory/ntap-20231110-0002/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32636","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499."}]},{"artifact":{"id":"5c842fe0f64f5a4c","cpes":["cpe:2.3:a:libssh:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh","purl":"pkg:rpm/redhat/libssh@0.9.6-17.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5351","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0:0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-5351","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5351","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5351","date":"2026-11-07","epss":0.0063,"percentile":0.50465}],"risk":0.36224999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5351","description":"A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed."},"relatedVulnerabilities":[{"id":"CVE-2025-5351","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5351","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5351","date":"2026-11-07","epss":0.0063,"percentile":0.50465}],"urls":["https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2025-5351","https://bugzilla.redhat.com/show_bug.cgi?id=2369367"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5351","description":"A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed."}]},{"artifact":{"id":"bd8c4541a903d30b","cpes":["cpe:2.3:a:libssh-config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh-config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh-config","purl":"pkg:rpm/redhat/libssh-config@0.9.6-17.el8_10?arch=noarch&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libssh","version":"0.9.6-17.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5351","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-5351","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5351","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5351","date":"2026-11-07","epss":0.0063,"percentile":0.50465}],"risk":0.36224999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5351","description":"A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed."},"relatedVulnerabilities":[{"id":"CVE-2025-5351","cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5351","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5351","date":"2026-11-07","epss":0.0063,"percentile":0.50465}],"urls":["https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2025-5351","https://bugzilla.redhat.com/show_bug.cgi?id=2369367"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5351","description":"A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed."}]},{"artifact":{"id":"c22794ff3ec67fe8","cpes":["cpe:2.3:a:redhat:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.56.4-177.el8_10?arch=x86_64&distro=rhel-8.10&upstream=glib2-2.56.4-177.el8_10.src.rpm","type":"rpm","version":"2.56.4-177.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-29499","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glib2","version":"0:2.56.4-177.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-29499","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-29499","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-29499","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-29499","date":"2026-11-07","epss":0.00785,"percentile":0.56329}],"risk":0.3611,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-29499","description":"A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-29499","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-29499","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-29499","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-29499","date":"2026-11-07","epss":0.00785,"percentile":0.56329}],"urls":["https://access.redhat.com/security/cve/CVE-2023-29499","https://bugzilla.redhat.com/show_bug.cgi?id=2211828","https://gitlab.gnome.org/GNOME/glib/-/issues/2794","https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html","https://security.gentoo.org/glsa/202311-18","https://security.netapp.com/advisory/ntap-20231103-0001/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-29499","description":"A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.16.2-5.14.el8_10.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-81634","versionConstraint":"< 0:1.16.2-5.14.el8_10.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-81634","fix":{"state":"fixed","versions":["0:1.16.2-5.14.el8_10.4"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"0:1.16.2-5.14.el8_10.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81634","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-81634","date":"2026-11-07","epss":0.0048,"percentile":0.41629}],"risk":0.36,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:70754","link":"https://access.redhat.com/errata/RHSA-2026:70754"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-81634","description":"A flaw was found in Unbound. This vulnerability allows a remote attacker to cause a heap buffer overflow during the processing of DNSSEC responses. By sending a specially crafted DNSSEC response, a malicious server or an attacker tampering with network traffic can trigger this flaw. This could lead to a denial of service, making the Unbound service unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-81634","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81634","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-81634","date":"2026-11-07","epss":0.0048,"percentile":0.41629}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81634","description":"In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:1.16.2-5.14.el8_10.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-81634","versionConstraint":"< 0:1.16.2-5.14.el8_10.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-81634","fix":{"state":"fixed","versions":["0:1.16.2-5.14.el8_10.4"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"0:1.16.2-5.14.el8_10.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81634","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-81634","date":"2026-11-07","epss":0.0048,"percentile":0.41629}],"risk":0.36,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:70754","link":"https://access.redhat.com/errata/RHSA-2026:70754"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-81634","description":"A flaw was found in Unbound. This vulnerability allows a remote attacker to cause a heap buffer overflow during the processing of DNSSEC responses. By sending a specially crafted DNSSEC response, a malicious server or an attacker tampering with network traffic can trigger this flaw. This could lead to a denial of service, making the Unbound service unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-81634","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81634","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-81634","date":"2026-11-07","epss":0.0048,"percentile":0.41629}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81634","description":"In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability."}]},{"artifact":{"id":"c268f72ac3a7ab82","cpes":["cpe:2.3:a:json-glib:json-glib:1.4.4-1.el8:*:*:*:*:*:*:*","cpe:2.3:a:json-glib:json_glib:1.4.4-1.el8:*:*:*:*:*:*:*","cpe:2.3:a:json_glib:json-glib:1.4.4-1.el8:*:*:*:*:*:*:*","cpe:2.3:a:json_glib:json_glib:1.4.4-1.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:json-glib:1.4.4-1.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:json_glib:1.4.4-1.el8:*:*:*:*:*:*:*","cpe:2.3:a:json:json-glib:1.4.4-1.el8:*:*:*:*:*:*:*","cpe:2.3:a:json:json_glib:1.4.4-1.el8:*:*:*:*:*:*:*"],"name":"json-glib","purl":"pkg:rpm/redhat/json-glib@1.4.4-1.el8?arch=x86_64&distro=rhel-8.10&upstream=json-glib-1.4.4-1.el8.src.rpm","type":"rpm","version":"1.4.4-1.el8","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-120194","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"json-glib","version":"0:1.4.4-1.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-120194","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120194","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-120194","date":"2026-11-07","epss":0.00475,"percentile":0.41313}],"risk":0.35624999999999996,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-120194","description":"A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-120194","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120194","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-120194","date":"2026-11-07","epss":0.00475,"percentile":0.41313}],"urls":["https://access.redhat.com/security/cve/CVE-2026-120194","https://bugzilla.redhat.com/show_bug.cgi?id=2564418","https://gitlab.gnome.org/GNOME/json-glib/-/issues/96"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120194","description":"A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5773","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-5773","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-11-07","epss":0.00618,"percentile":0.49879}],"risk":0.35534999999999994,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5773","description":"A flaw was found in libcurl. Due to a logical error in the connection reuse mechanism for SMB (Server Message Block) transfers, libcurl might reuse an existing SMB connection with a different share than intended. This vulnerability, categorized as CWE-488 (Exposure of Data Element to Wrong Session), could lead to the download of an incorrect file or the upload of a file to an unintended location when an application uses libcurl for SMB transfers."},"relatedVulnerabilities":[{"id":"CVE-2026-5773","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-11-07","epss":0.00618,"percentile":0.49879}],"urls":["https://curl.se/docs/CVE-2026-5773.html","https://curl.se/docs/CVE-2026-5773.json","https://hackerone.com/reports/3650689","http://www.openwall.com/lists/oss-security/2026/04/29/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","description":"libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5773","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-5773","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-11-07","epss":0.00618,"percentile":0.49879}],"risk":0.35534999999999994,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5773","description":"A flaw was found in libcurl. Due to a logical error in the connection reuse mechanism for SMB (Server Message Block) transfers, libcurl might reuse an existing SMB connection with a different share than intended. This vulnerability, categorized as CWE-488 (Exposure of Data Element to Wrong Session), could lead to the download of an incorrect file or the upload of a file to an unintended location when an application uses libcurl for SMB transfers."},"relatedVulnerabilities":[{"id":"CVE-2026-5773","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-11-07","epss":0.00618,"percentile":0.49879}],"urls":["https://curl.se/docs/CVE-2026-5773.html","https://curl.se/docs/CVE-2026-5773.json","https://hackerone.com/reports/3650689","http://www.openwall.com/lists/oss-security/2026/04/29/9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","description":"libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same."}]},{"artifact":{"id":"5c842fe0f64f5a4c","cpes":["cpe:2.3:a:libssh:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh","purl":"pkg:rpm/redhat/libssh@0.9.6-17.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0966","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0:0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0966","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0966","cwe":"CWE-124","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0966","date":"2026-11-07","epss":0.00604,"percentile":0.49167}],"risk":0.3473,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0966","description":"A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process."},"relatedVulnerabilities":[{"id":"CVE-2026-0966","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0966","cwe":"CWE-124","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0966","date":"2026-11-07","epss":0.00604,"percentile":0.49167}],"urls":["https://access.redhat.com/errata/RHSA-2026:18160","https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/errata/RHSA-2026:7067","https://access.redhat.com/security/cve/CVE-2026-0966","https://bugzilla.redhat.com/show_bug.cgi?id=2433121","https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0966","description":"A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process."}]},{"artifact":{"id":"bd8c4541a903d30b","cpes":["cpe:2.3:a:libssh-config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh-config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh-config","purl":"pkg:rpm/redhat/libssh-config@0.9.6-17.el8_10?arch=noarch&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libssh","version":"0.9.6-17.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0966","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0966","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0966","cwe":"CWE-124","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0966","date":"2026-11-07","epss":0.00604,"percentile":0.49167}],"risk":0.3473,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0966","description":"A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process."},"relatedVulnerabilities":[{"id":"CVE-2026-0966","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0966","cwe":"CWE-124","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0966","date":"2026-11-07","epss":0.00604,"percentile":0.49167}],"urls":["https://access.redhat.com/errata/RHSA-2026:18160","https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/errata/RHSA-2026:7067","https://access.redhat.com/security/cve/CVE-2026-0966","https://bugzilla.redhat.com/show_bug.cgi?id=2433121","https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0966","description":"A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-07","epss":0.00672,"percentile":0.52292}],"risk":0.34608000000000005,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7210","description":"A flaw was found in the `python` and `expat` components. Insufficient entropy in the hash-flooding protection mechanism of `xml.parsers.expat` and `xml.etree.ElementTree` allows a remote attacker to craft a malicious XML document. This crafted document can trigger a hash flooding attack, leading to a denial of service (DoS) condition."},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-07","epss":0.00672,"percentile":0.52292}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-07","epss":0.00672,"percentile":0.52292}],"risk":0.34608000000000005,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7210","description":"A flaw was found in the `python` and `expat` components. Insufficient entropy in the hash-flooding protection mechanism of `xml.parsers.expat` and `xml.etree.ElementTree` allows a remote attacker to craft a malicious XML document. This crafted document can trigger a hash flooding attack, leading to a denial of service (DoS) condition."},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-07","epss":0.00672,"percentile":0.52292}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7774","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-7774","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7774","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7774","date":"2026-11-07","epss":0.00598,"percentile":0.48895}],"risk":0.34385,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7774","description":"A flaw was found in the `tarfile.data_filter` function within the Python `tarfile` module. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive containing malicious link entries, such as symlinks with empty or directory-like names. This bypass allows the attacker to redirect subsequent archive members outside the intended extraction directory, leading to arbitrary file writes on the system where the archive is extracted. The impact of this flaw is limited by the permissions of the extracting process."},"relatedVulnerabilities":[{"id":"CVE-2026-7774","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7774","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7774","date":"2026-11-07","epss":0.00598,"percentile":0.48895}],"urls":["https://github.com/python/cpython/commit/0478bd83d82b255e0f29f613367a59d261e7eaa2","https://github.com/python/cpython/commit/0d28f5e46e151718972dfabd91205444d0037b6d","https://github.com/python/cpython/commit/10a13bee3c24f9c62b602e696334ff2272a40efc","https://github.com/python/cpython/commit/578411982c16f753f4893532510099ef665117da","https://github.com/python/cpython/commit/5cf47a248c35c375d610b87b2f72fd1ed454b558","https://github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf","https://github.com/python/cpython/commit/c063191cb7f9170f9565e305f8aa2b79ab2bf609","https://github.com/python/cpython/issues/149486","https://github.com/python/cpython/pull/149487","https://mail.python.org/archives/list/security-announce@python.org/thread/4FU62L2M6RMMHT2QPGQNPEHHUND7CEX5/","http://www.openwall.com/lists/oss-security/2026/06/04/9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7774","description":"tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7774","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-7774","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7774","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7774","date":"2026-11-07","epss":0.00598,"percentile":0.48895}],"risk":0.34385,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7774","description":"A flaw was found in the `tarfile.data_filter` function within the Python `tarfile` module. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive containing malicious link entries, such as symlinks with empty or directory-like names. This bypass allows the attacker to redirect subsequent archive members outside the intended extraction directory, leading to arbitrary file writes on the system where the archive is extracted. The impact of this flaw is limited by the permissions of the extracting process."},"relatedVulnerabilities":[{"id":"CVE-2026-7774","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7774","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7774","date":"2026-11-07","epss":0.00598,"percentile":0.48895}],"urls":["https://github.com/python/cpython/commit/0478bd83d82b255e0f29f613367a59d261e7eaa2","https://github.com/python/cpython/commit/0d28f5e46e151718972dfabd91205444d0037b6d","https://github.com/python/cpython/commit/10a13bee3c24f9c62b602e696334ff2272a40efc","https://github.com/python/cpython/commit/578411982c16f753f4893532510099ef665117da","https://github.com/python/cpython/commit/5cf47a248c35c375d610b87b2f72fd1ed454b558","https://github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf","https://github.com/python/cpython/commit/c063191cb7f9170f9565e305f8aa2b79ab2bf609","https://github.com/python/cpython/issues/149486","https://github.com/python/cpython/pull/149487","https://mail.python.org/archives/list/security-announce@python.org/thread/4FU62L2M6RMMHT2QPGQNPEHHUND7CEX5/","http://www.openwall.com/lists/oss-security/2026/06/04/9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7774","description":"tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7383","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-7383","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.8,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-11-07","epss":0.00804,"percentile":0.56967}],"risk":0.34170000000000006,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7383","description":"A flaw was found in OpenSSL. A signed integer overflow vulnerability exists when sizing the destination buffer for Unicode output. This can lead to a heap buffer overflow, which may result in a crash or potentially allow an attacker to execute arbitrary code. Exploitation requires an application to directly call specific functions with a large amount of attacker-controlled input."},"relatedVulnerabilities":[{"id":"CVE-2026-7383","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-11-07","epss":0.00804,"percentile":0.56967}],"urls":["https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6","https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083","https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","description":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7383","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-7383","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.8,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-11-07","epss":0.00804,"percentile":0.56967}],"risk":0.34170000000000006,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7383","description":"A flaw was found in OpenSSL. A signed integer overflow vulnerability exists when sizing the destination buffer for Unicode output. This can lead to a heap buffer overflow, which may result in a crash or potentially allow an attacker to execute arbitrary code. Exploitation requires an application to directly call specific functions with a large amount of attacker-controlled input."},"relatedVulnerabilities":[{"id":"CVE-2026-7383","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-11-07","epss":0.00804,"percentile":0.56967}],"urls":["https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6","https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083","https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","description":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"9596d540aa4016c7","cpes":["cpe:2.3:a:redhat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-2.el8_10.2?arch=x86_64&distro=rhel-8.10&upstream=expat-2.5.0-2.el8_10.2.src.rpm","type":"rpm","version":"2.5.0-2.el8_10.2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115506","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"expat","version":"0:2.5.0-2.el8_10.2"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-115506","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-07","epss":0.00448,"percentile":0.39184}],"risk":0.33599999999999997,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-115506","description":"A flaw was found in expat. The parser's protection mechanism against recursive entity expansion detects amplification thresholds too late during document processing. A remote attacker can exploit this vulnerability by supplying a crafted XML document with nested entity definitions, causing excessive CPU consumption and resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-115506","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-07","epss":0.00448,"percentile":0.39184}],"urls":["https://github.com/hannob/lololol","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/issues/1160","https://github.com/libexpat/libexpat/pull/1433","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse."}]},{"artifact":{"id":"2740ea74c614de4e","cpes":["cpe:2.3:a:libevent:libevent:2.1.8-5.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libevent:2.1.8-5.el8:*:*:*:*:*:*:*"],"name":"libevent","purl":"pkg:rpm/redhat/libevent@2.1.8-5.el8?arch=x86_64&distro=rhel-8.10&upstream=libevent-2.1.8-5.el8.src.rpm","type":"rpm","version":"2.1.8-5.el8","language":"","licenses":["BSD and ISC"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.1.8-11.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63387","versionConstraint":"< 0:2.1.8-11.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libevent","version":"0:2.1.8-5.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-63387","fix":{"state":"fixed","versions":["0:2.1.8-11.el8_10"],"available":[{"date":"2026-09-17","kind":"first-observed","version":"0:2.1.8-11.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63387","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63387","date":"2026-11-07","epss":0.00416,"percentile":0.36131}],"risk":0.33487999999999996,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:67908","link":"https://access.redhat.com/errata/RHSA-2026:67908"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-63387","description":"A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the `dnsname_to_labels` function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the process, resulting in a denial of service or potential information disclosure and integrity impact."},"relatedVulnerabilities":[{"id":"CVE-2026-63387","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63387","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63387","date":"2026-11-07","epss":0.00416,"percentile":0.36131}],"urls":["https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63387","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"3fa5e9a1b5f18fed","cpes":["cpe:2.3:a:redhat:pcre2:10.32-3.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.32-3.el8_6:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=rhel-8.10&upstream=pcre2-10.32-3.el8_6.src.rpm","type":"rpm","version":"10.32-3.el8_6","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.32-4.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"< 0:10.32-4.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"pcre2","version":"0:10.32-3.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"fixed","versions":["0:10.32-4.el8_10"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.32-4.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-11-07","epss":0.00425,"percentile":0.36979}],"risk":0.333625,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:81613","link":"https://access.redhat.com/errata/RHSA-2026:81613"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86145","description":"A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system."},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-11-07","epss":0.00425,"percentile":0.36979}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"8d28acbe9944600a","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-base:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_base:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-19211","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-19211","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-19211","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-19211","date":"2026-11-07","epss":0.00863,"percentile":0.58837}],"risk":0.332255,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-19211","description":"A vulnerability was found in GNU ncurses due to a NULL pointer dereference in the _nc_parse_entry function within parse_entry.c, where an attacker could exploit this flaw by persuading a victim to open a specially crafted file, leading to a crash and causing a denial of service condition."},"relatedVulnerabilities":[{"id":"CVE-2018-19211","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-19211","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-19211","date":"2026-11-07","epss":0.00863,"percentile":0.58837}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1643754"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-19211","description":"In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a \"dubious character `*' in name or alias field\" detection."}]},{"artifact":{"id":"740497c732ce2972","cpes":["cpe:2.3:a:ncurses-libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_libs:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses-libs:6.1-10.20180224.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ncurses_libs:6.1-10.20180224.el8:*:*:*:*:*:*:*"],"name":"ncurses-libs","purl":"pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=rhel-8.10&upstream=ncurses-6.1-10.20180224.el8.src.rpm","type":"rpm","version":"6.1-10.20180224.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ncurses","version":"6.1-10.20180224.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-19211","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ncurses","version":"6.1-10.20180224.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2018-19211","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-19211","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-19211","date":"2026-11-07","epss":0.00863,"percentile":0.58837}],"risk":0.332255,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2018-19211","description":"A vulnerability was found in GNU ncurses due to a NULL pointer dereference in the _nc_parse_entry function within parse_entry.c, where an attacker could exploit this flaw by persuading a victim to open a specially crafted file, leading to a crash and causing a denial of service condition."},"relatedVulnerabilities":[{"id":"CVE-2018-19211","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-19211","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-19211","date":"2026-11-07","epss":0.00863,"percentile":0.58837}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1643754"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-19211","description":"In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a \"dubious character `*' in name or alias field\" detection."}]},{"artifact":{"id":"9d3dac95074ed386","cpes":["cpe:2.3:a:libpcap:libpcap:14\\:1.9.1-5.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libpcap:14\\:1.9.1-5.el8:*:*:*:*:*:*:*"],"name":"libpcap","purl":"pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=rhel-8.10&epoch=14&upstream=libpcap-1.9.1-5.el8.src.rpm","type":"rpm","version":"14:1.9.1-5.el8","language":"","licenses":["BSD with advertising"],"metadata":{"epoch":14,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6554","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libpcap","version":"14:1.9.1-5.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-6554","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6554","cwe":"CWE-835","type":"Secondary","source":"security@tcpdump.org"}],"epss":[{"cve":"CVE-2026-6554","date":"2026-11-07","epss":0.0044,"percentile":0.38502}],"risk":0.33,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6554","description":"A flaw was found in libpcap. The Berkeley Packet Filter (BPF) interpreter incorrectly handles offsets in 'ja L' instructions, allowing backward jumps without limiting loop iterations. A local attacker could provide a specially crafted filter program, leading to an infinite loop and causing a Denial of Service (DoS) condition."},"relatedVulnerabilities":[{"id":"CVE-2026-6554","cvss":[{"type":"Secondary","source":"security@tcpdump.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6554","cwe":"CWE-835","type":"Secondary","source":"security@tcpdump.org"}],"epss":[{"cve":"CVE-2026-6554","date":"2026-11-07","epss":0.0044,"percentile":0.38502}],"urls":["https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b6e14795a8e0ce","http://www.openwall.com/lists/oss-security/2026/10/22/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6554","description":"libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations.  A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-54874","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-11-07","epss":0.00622,"percentile":0.50053}],"risk":0.32655,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-54874","description":"A flaw was found in OpenSSL. Receiving a DTLS (Datagram Transport Layer Security) record for a future epoch while a handshake is in progress causes OpenSSL to buffer an excessive amount of memory. This allows a peer to cause memory exhaustion, eventually resulting in a denial of service, using a small amount of network traffic."},"relatedVulnerabilities":[{"id":"CVE-2026-54874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-11-07","epss":0.00622,"percentile":0.50053}],"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54874","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-11-07","epss":0.00622,"percentile":0.50053}],"risk":0.32655,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-54874","description":"A flaw was found in OpenSSL. Receiving a DTLS (Datagram Transport Layer Security) record for a future epoch while a handshake is in progress causes OpenSSL to buffer an excessive amount of memory. This allows a peer to cause memory exhaustion, eventually resulting in a denial of service, using a small amount of network traffic."},"relatedVulnerabilities":[{"id":"CVE-2026-54874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-11-07","epss":0.00622,"percentile":0.50053}],"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0397","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-0397","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-07","epss":0.0081,"percentile":0.57154}],"risk":0.32399999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-0397","description":"A vulnerability was found in Python. A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time that certificates are loaded into the SSLContext, such as during the TLS handshake with a  configured certificate directory."},"relatedVulnerabilities":[{"id":"CVE-2024-0397","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-07","epss":0.0081,"percentile":0.57154}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/2","https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","https://github.com/python/cpython/issues/114572","https://github.com/python/cpython/pull/114573","https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20250411-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0397","description":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0397","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-0397","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-07","epss":0.0081,"percentile":0.57154}],"risk":0.32399999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-0397","description":"A vulnerability was found in Python. A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time that certificates are loaded into the SSLContext, such as during the TLS handshake with a  configured certificate directory."},"relatedVulnerabilities":[{"id":"CVE-2024-0397","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0397","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0397","date":"2026-11-07","epss":0.0081,"percentile":0.57154}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/17/2","https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d","https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524","https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e","https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286","https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa","https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab","https://github.com/python/cpython/issues/114572","https://github.com/python/cpython/pull/114573","https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://security.netapp.com/advisory/ntap-20250411-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0397","description":"A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-14524","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-11-07","epss":0.0068,"percentile":0.52652}],"risk":0.32299999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14524","description":"A flaw was found in curl. When an OAuth2 (Open Authorization) bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a different scheme like IMAP, LDAP, POP3, or SMTP, curl might incorrectly pass the bearer token to the new target host. This could lead to information disclosure, where sensitive authentication tokens are exposed to unintended recipients."},"relatedVulnerabilities":[{"id":"CVE-2025-14524","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-11-07","epss":0.0068,"percentile":0.52652}],"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14524","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-11-07","epss":0.0068,"percentile":0.52652}],"risk":0.32299999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-14524","description":"A flaw was found in curl. When an OAuth2 (Open Authorization) bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a different scheme like IMAP, LDAP, POP3, or SMTP, curl might incorrectly pass the bearer token to the new target host. This could lead to information disclosure, where sensitive authentication tokens are exposed to unintended recipients."},"relatedVulnerabilities":[{"id":"CVE-2025-14524","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-11-07","epss":0.0068,"percentile":0.52652}],"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."}]},{"artifact":{"id":"14f406c5bcf8faf4","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.7?arch=x86_64&distro=rhel-8.10&upstream=libxml2-2.9.7-21.el8_10.7.src.rpm","type":"rpm","version":"2.9.7-21.el8_10.7","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-27113","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libxml2","version":"0:2.9.7-21.el8_10.7"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-27113","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-27113","date":"2026-11-07","epss":0.01053,"percentile":0.64567}],"risk":0.321165,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-27113","description":"A flaw was found in libxml2. This vulnerability allows a NULL pointer dereference, leading to a potential crash or denial of service via a crafted XML pattern."},"relatedVulnerabilities":[{"id":"CVE-2025-27113","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-27113","date":"2026-11-07","epss":0.01053,"percentile":0.64567}],"urls":["https://gitlab.gnome.org/GNOME/libxml2/-/issues/861","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html","https://security.netapp.com/advisory/ntap-20250306-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27113","description":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-07","epss":0.00676,"percentile":0.52489}],"risk":0.3211,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86414","description":"A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge, curl mishandles the response and transmits the origin server's credentials. This issue leads to information disclosure, allowing an untrusted proxy to intercept sensitive passwords and authentication tokens."},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-07","epss":0.00676,"percentile":0.52489}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-07","epss":0.00676,"percentile":0.52489}],"risk":0.3211,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86414","description":"A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge, curl mishandles the response and transmits the origin server's credentials. This issue leads to information disclosure, allowing an untrusted proxy to intercept sensitive passwords and authentication tokens."},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-07","epss":0.00676,"percentile":0.52489}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"45c8f2a88ad57c26","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.2.20-4.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.2.20-4.el8_10:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gnupg2-2.2.20-4.el8_10.src.rpm","type":"rpm","version":"2.2.20-4.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gnupg2","version":"0:2.2.20-4.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-07","epss":0.0043,"percentile":0.37481}],"risk":0.3182,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-118131","description":"A flaw was found in GnuPG for Windows. Insecure default Discretionary Access Control List (DACL) permissions allow low-privileged local users to create subdirectories under the shared program data directory. A local attacker can exploit this issue by pre-creating the expected configuration directory and planting malicious configuration files. When a victim user executes GnuPG components, these files are loaded, resulting in arbitrary code execution within the security context of the victim user."},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-07","epss":0.0043,"percentile":0.37481}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-07","epss":0.00534,"percentile":0.45341}],"risk":0.31506,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-115557","description":"The eMudha certificate authority issues a set of intermediate CA certificates with weak private keys. A man-in-the-middle attacker could use these weak intermediate CA certificates to issue certificates for arbitrary host names and have them accepted by TLS/SSL clients as valid if those clients trusted root certificate authorities which signed these weak intermediate CA certificates. The Python ssl module was modified to reject these weak intermediate CA certificates regardless of whether issues root CAs are trusted."},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-07","epss":0.00534,"percentile":0.45341}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-07","epss":0.00534,"percentile":0.45341}],"risk":0.31506,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-115557","description":"The eMudha certificate authority issues a set of intermediate CA certificates with weak private keys. A man-in-the-middle attacker could use these weak intermediate CA certificates to issue certificates for arbitrary host names and have them accepted by TLS/SSL clients as valid if those clients trusted root certificate authorities which signed these weak intermediate CA certificates. The Python ssl module was modified to reject these weak intermediate CA certificates regardless of whether issues root CAs are trusted."},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-07","epss":0.00534,"percentile":0.45341}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9076","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-9076","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-11-07","epss":0.00707,"percentile":0.53658}],"risk":0.31461500000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9076","description":"A flaw was found in OpenSSL. When processing attacker-supplied Cryptographic Message Syntax (CMS) data using password-based decryption, an attacker can choose a stream-mode Key Encryption Key (KEK) cipher. This can trigger a heap out-of-bounds read, potentially causing an application crash and leading to a Denial of Service (DoS). This vulnerability does not require password knowledge and can be exploited before authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-9076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-11-07","epss":0.00707,"percentile":0.53658}],"urls":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9076","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-9076","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-11-07","epss":0.00707,"percentile":0.53658}],"risk":0.31461500000000003,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9076","description":"A flaw was found in OpenSSL. When processing attacker-supplied Cryptographic Message Syntax (CMS) data using password-based decryption, an attacker can choose a stream-mode Key Encryption Key (KEK) cipher. This can trigger a heap out-of-bounds read, potentially causing an application crash and leading to a Denial of Service (DoS). This vulnerability does not require password knowledge and can be exploited before authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-9076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-11-07","epss":0.00707,"percentile":0.53658}],"urls":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."}]},{"artifact":{"id":"93eed475e569196b","cpes":["cpe:2.3:a:platform-python-pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python-pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"platform-python-pip","purl":"pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50182","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-50182","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50182","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50182","date":"2026-11-07","epss":0.00602,"percentile":0.49034}],"risk":0.31003000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-50182","description":"A flaw was found in urllib3. The library fails to properly validate redirect URLs, allowing an attacker to manipulate redirect chains when used in environments like Pyodide utilizing the JavaScript Fetch API. This lack of validation can enable a remote attacker to control the redirect destination, leading to arbitrary URL redirection. Consequently, an attacker can redirect users to malicious websites. This \nvulnerability stems from a failure to constrain the redirect target."},"relatedVulnerabilities":[{"id":"CVE-2025-50182","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50182","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50182","date":"2026-11-07","epss":0.00602,"percentile":0.49034}],"urls":["https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f","https://github.com/urllib3/urllib3/releases/tag/2.5.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182","description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0."}]},{"artifact":{"id":"fa83cdeeda4e9e6a","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50182","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-50182","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50182","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50182","date":"2026-11-07","epss":0.00602,"percentile":0.49034}],"risk":0.31003000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-50182","description":"A flaw was found in urllib3. The library fails to properly validate redirect URLs, allowing an attacker to manipulate redirect chains when used in environments like Pyodide utilizing the JavaScript Fetch API. This lack of validation can enable a remote attacker to control the redirect destination, leading to arbitrary URL redirection. Consequently, an attacker can redirect users to malicious websites. This \nvulnerability stems from a failure to constrain the redirect target."},"relatedVulnerabilities":[{"id":"CVE-2025-50182","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50182","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50182","date":"2026-11-07","epss":0.00602,"percentile":0.49034}],"urls":["https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f","https://github.com/urllib3/urllib3/releases/tag/2.5.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182","description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15079","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-15079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-11-07","epss":0.0055,"percentile":0.46239}],"risk":0.30524999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15079","description":"A flaw was found in curl. When performing SSH-based transfers using SCP or SFTP, libcurl could mistakenly connect to hosts not listed in the user-specified knownhosts file. This occurs if the host is present in the libssh global knownhosts file, effectively bypassing the intended host verification. This could allow a remote attacker to connect to an untrusted host, potentially leading to information disclosure or man-in-the-middle attacks."},"relatedVulnerabilities":[{"id":"CVE-2025-15079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-11-07","epss":0.0055,"percentile":0.46239}],"urls":["https://curl.se/docs/CVE-2025-15079.html","https://curl.se/docs/CVE-2025-15079.json","https://hackerone.com/reports/3477116","http://www.openwall.com/lists/oss-security/2026/01/07/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","description":"When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15079","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-15079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-11-07","epss":0.0055,"percentile":0.46239}],"risk":0.30524999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15079","description":"A flaw was found in curl. When performing SSH-based transfers using SCP or SFTP, libcurl could mistakenly connect to hosts not listed in the user-specified knownhosts file. This occurs if the host is present in the libssh global knownhosts file, effectively bypassing the intended host verification. This could allow a remote attacker to connect to an untrusted host, potentially leading to information disclosure or man-in-the-middle attacks."},"relatedVulnerabilities":[{"id":"CVE-2025-15079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-11-07","epss":0.0055,"percentile":0.46239}],"urls":["https://curl.se/docs/CVE-2025-15079.html","https://curl.se/docs/CVE-2025-15079.json","https://hackerone.com/reports/3477116","http://www.openwall.com/lists/oss-security/2026/01/07/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","description":"When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9080","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-9080","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-11-07","epss":0.00494,"percentile":0.42663}],"risk":0.30380999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9080","description":"A flaw was found in libcurl. When `curl_easy_pause()` is called within the event-based `CURLMOPT_SOCKETFUNCTION` callback, a use-after-free vulnerability is triggered. This occurs because libcurl attempts to store a flag using a pointer to memory that has already been freed. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code."},"relatedVulnerabilities":[{"id":"CVE-2026-9080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-11-07","epss":0.00494,"percentile":0.42663}],"urls":["https://curl.se/docs/CVE-2026-9080.html","https://curl.se/docs/CVE-2026-9080.json","https://hackerone.com/reports/3749204"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9080","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-9080","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-11-07","epss":0.00494,"percentile":0.42663}],"risk":0.30380999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9080","description":"A flaw was found in libcurl. When `curl_easy_pause()` is called within the event-based `CURLMOPT_SOCKETFUNCTION` callback, a use-after-free vulnerability is triggered. This occurs because libcurl attempts to store a flag using a pointer to memory that has already been freed. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code."},"relatedVulnerabilities":[{"id":"CVE-2026-9080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-11-07","epss":0.00494,"percentile":0.42663}],"urls":["https://curl.se/docs/CVE-2026-9080.html","https://curl.se/docs/CVE-2026-9080.json","https://hackerone.com/reports/3749204"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed."}]},{"artifact":{"id":"9596d540aa4016c7","cpes":["cpe:2.3:a:redhat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-2.el8_10.2?arch=x86_64&distro=rhel-8.10&upstream=expat-2.5.0-2.el8_10.2.src.rpm","type":"rpm","version":"2.5.0-2.el8_10.2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.5.0-4.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"< 0:2.5.0-4.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"expat","version":"0:2.5.0-2.el8_10.2"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"fixed","versions":["0:2.5.0-4.el8_10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"0:2.5.0-4.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-11-07","epss":0.00403,"percentile":0.34833}],"risk":0.30225,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:72448","link":"https://access.redhat.com/errata/RHSA-2026:72448"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-93990","description":"A flaw was found in Expat. This vulnerability allows a remote attacker to send specially crafted UTF-16 encoded XML data. Due to improper validation of surrogate characters, the parser can be tricked into accepting malformed sequences, which can hide legitimate markup characters. This could enable XML injection attacks, potentially leading to information disclosure or other integrity impacts."},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-11-07","epss":0.00403,"percentile":0.34833}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6429","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-11-07","epss":0.00519,"percentile":0.44354}],"risk":0.298425,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6429","description":"A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6429","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-11-07","epss":0.00519,"percentile":0.44354}],"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6429","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-11-07","epss":0.00519,"percentile":0.44354}],"risk":0.298425,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6429","description":"A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials."},"relatedVulnerabilities":[{"id":"CVE-2026-6429","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-11-07","epss":0.00519,"percentile":0.44354}],"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."}]},{"artifact":{"id":"2740ea74c614de4e","cpes":["cpe:2.3:a:libevent:libevent:2.1.8-5.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libevent:2.1.8-5.el8:*:*:*:*:*:*:*"],"name":"libevent","purl":"pkg:rpm/redhat/libevent@2.1.8-5.el8?arch=x86_64&distro=rhel-8.10&upstream=libevent-2.1.8-5.el8.src.rpm","type":"rpm","version":"2.1.8-5.el8","language":"","licenses":["BSD and ISC"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63379","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libevent","version":"0:2.1.8-5.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-63379","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63379","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63379","date":"2026-11-07","epss":0.00518,"percentile":0.44313}],"risk":0.29785,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-63379","description":"A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP (Hypertext Transfer Protocol) trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers, causing an upstream proxy and the Libevent application to interpret different effective headers. This can lead to header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning."},"relatedVulnerabilities":[{"id":"CVE-2026-63379","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63379","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63379","date":"2026-11-07","epss":0.00518,"percentile":0.44313}],"urls":["https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636","https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63379","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"ff25387491f3ba91","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-11-07","epss":0.00572,"percentile":0.47536}],"risk":0.29458,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-11-07","epss":0.00572,"percentile":0.47536}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"c0992ee9cbf195f6","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.18.9:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.18.9:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.9","type":"java-archive","version":"2.18.9","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"093f3c1564ae82c1f5c034883f9ce45782054e04","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jackson-databind-2.18.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.18.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.8.0,<2.18.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.18.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.18.10"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.18.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-11-07","epss":0.00572,"percentile":0.47536}],"risk":0.29458,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-11-07","epss":0.00572,"percentile":0.47536}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11468","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-11468","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.5,"impactScore":3.6,"exploitabilityScore":1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-11-07","epss":0.00616,"percentile":0.49742}],"risk":0.29259999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11468","description":"Missing character filtering has been discovered in Python. When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."},"relatedVulnerabilities":[{"id":"CVE-2025-11468","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-11-07","epss":0.00616,"percentile":0.49742}],"urls":["https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094","https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2","https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6","https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66","https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0","https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796","https://github.com/python/cpython/issues/143935","https://github.com/python/cpython/pull/143936","https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11468","description":"When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11468","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-11468","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.5,"impactScore":3.6,"exploitabilityScore":1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-11-07","epss":0.00616,"percentile":0.49742}],"risk":0.29259999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11468","description":"Missing character filtering has been discovered in Python. When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."},"relatedVulnerabilities":[{"id":"CVE-2025-11468","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11468","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11468","date":"2026-11-07","epss":0.00616,"percentile":0.49742}],"urls":["https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094","https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2","https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6","https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66","https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0","https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796","https://github.com/python/cpython/issues/143935","https://github.com/python/cpython/pull/143936","https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11468","description":"When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:7.61.1-34.el8_10.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8458","versionConstraint":"< 0:7.61.1-34.el8_10.18 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-8458","fix":{"state":"fixed","versions":["0:7.61.1-34.el8_10.18"],"available":[{"date":"2026-10-30","kind":"first-observed","version":"0:7.61.1-34.el8_10.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-11-07","epss":0.00371,"percentile":0.31281}],"risk":0.28938,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92368","link":"https://access.redhat.com/errata/RHSA-2026:92368"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8458","description":"A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different service, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-8458","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-11-07","epss":0.00371,"percentile":0.31281}],"urls":["https://curl.se/docs/CVE-2026-8458.html","https://curl.se/docs/CVE-2026-8458.json","https://hackerone.com/reports/3721183"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:7.61.1-34.el8_10.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8458","versionConstraint":"< 0:7.61.1-34.el8_10.18 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-8458","fix":{"state":"fixed","versions":["0:7.61.1-34.el8_10.18"],"available":[{"date":"2026-10-30","kind":"first-observed","version":"0:7.61.1-34.el8_10.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-11-07","epss":0.00371,"percentile":0.31281}],"risk":0.28938,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92368","link":"https://access.redhat.com/errata/RHSA-2026:92368"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8458","description":"A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different service, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-8458","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-11-07","epss":0.00371,"percentile":0.31281}],"urls":["https://curl.se/docs/CVE-2026-8458.html","https://curl.se/docs/CVE-2026-8458.json","https://hackerone.com/reports/3721183"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services."}]},{"artifact":{"id":"14a17f831ce6d6c1","cpes":["cpe:2.3:a:nmap-ncat:nmap-ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:nmap-ncat:nmap_ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:nmap_ncat:nmap-ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:nmap_ncat:nmap_ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nmap-ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:nmap_ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:nmap:nmap-ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:nmap:nmap_ncat:2\\:7.92-2.el8_10:*:*:*:*:*:*:*"],"name":"nmap-ncat","purl":"pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=rhel-8.10&epoch=2&upstream=nmap-7.92-2.el8_10.src.rpm","type":"rpm","version":"2:7.92-2.el8_10","language":"","licenses":["Nmap"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nmap","version":"7.92-2.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-72712","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"nmap","version":"7.92-2.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-72712","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72712","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-72712","date":"2026-11-07","epss":0.00499,"percentile":0.43055}],"risk":0.28692499999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-72712","description":"A flaw was found in Nmap. A remote attacker can exploit this denial of service vulnerability by sending a specially crafted packet that includes a zero-length Transmission Control Protocol (TCP) option. This malformed packet forces the application to enter an infinite loop during packet processing, consuming excessive memory and ultimately causing the Nmap application to crash."},"relatedVulnerabilities":[{"id":"CVE-2026-72712","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-72712","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-72712","date":"2026-11-07","epss":0.00499,"percentile":0.43055}],"urls":["https://github.com/nmap/nmap","https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a","https://github.com/nmap/nmap/issues/3368","https://www.vulncheck.com/advisories/nmap-denial-of-service-via-zero-length-tcp-option-packet"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-72712","description":"Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash."}]},{"artifact":{"id":"98d9819af65839e0","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.136.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.136.Final","type":"java-archive","version":"4.1.136.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/java/kafka/netty-handler-4.1.136.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"9114e02d69825eed3a901d762026261af15a56ea","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/netty-handler-4.1.136.Final.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/netty-handler-4.1.136.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4c3-7fpv-j4q5","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.136.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4c3-7fpv-j4q5","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-11-07","epss":0.00316,"percentile":0.24634}],"risk":0.28598,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5","https://nvd.nist.gov/vuln/detail/CVE-2026-75595","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4c3-7fpv-j4q5","description":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"},"relatedVulnerabilities":[{"id":"CVE-2026-75595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-11-07","epss":0.00316,"percentile":0.24634}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"9f1348c074e62048","cpes":["cpe:2.3:a:libgcc:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.5.0-30.el8_10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"< 0:8.5.0-30.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"fixed","versions":["0:8.5.0-30.el8_10"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"0:8.5.0-30.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-07","epss":0.00444,"percentile":0.38833}],"risk":0.28194,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:89830","link":"https://access.redhat.com/errata/RHSA-2026:89830"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-07","epss":0.00444,"percentile":0.38833}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"18d5838298e1194f","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.5.0-30.el8_10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"< 0:8.5.0-30.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"fixed","versions":["0:8.5.0-30.el8_10"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"0:8.5.0-30.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-07","epss":0.00444,"percentile":0.38833}],"risk":0.28194,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:89830","link":"https://access.redhat.com/errata/RHSA-2026:89830"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-07","epss":0.00444,"percentile":0.38833}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6069","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-6069","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-11-07","epss":0.00603,"percentile":0.4911}],"risk":0.28039499999999995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-6069","description":"A denial-of-service (DoS) vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource consumption, ultimately causing a denial-of-service condition in applications that rely on this parser."},"relatedVulnerabilities":[{"id":"CVE-2025-6069","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-11-07","epss":0.00603,"percentile":0.4911}],"urls":["https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949","https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41","https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49","https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5","https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b","https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc","https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15","https://github.com/python/cpython/issues/135462","https://github.com/python/cpython/pull/135464","https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6069","description":"The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6069","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-6069","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-11-07","epss":0.00603,"percentile":0.4911}],"risk":0.28039499999999995,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-6069","description":"A denial-of-service (DoS) vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource consumption, ultimately causing a denial-of-service condition in applications that rely on this parser."},"relatedVulnerabilities":[{"id":"CVE-2025-6069","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6069","cwe":"CWE-1333","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-6069","date":"2026-11-07","epss":0.00603,"percentile":0.4911}],"urls":["https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949","https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41","https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49","https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5","https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b","https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc","https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15","https://github.com/python/cpython/issues/135462","https://github.com/python/cpython/pull/135464","https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6069","description":"The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-07","epss":0.00589,"percentile":0.48418}],"risk":0.279775,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92390","description":"A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 (Early Hints) response or through specific header ordering. This flaw allows an attacker controlling a remote server to overwrite existing local files on the client system."},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-07","epss":0.00589,"percentile":0.48418}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-07","epss":0.00589,"percentile":0.48418}],"risk":0.279775,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92390","description":"A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 (Early Hints) response or through specific header ordering. This flaw allows an attacker controlling a remote server to overwrite existing local files on the client system."},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-07","epss":0.00589,"percentile":0.48418}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"57c644d21035769a","cpes":["cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy:1.1.10.5:*:*:*:*:*:*:*"],"name":"snappy-java","purl":"pkg:maven/org.xerial.snappy/snappy-java@1.1.10.5","type":"java-archive","version":"1.1.10.5","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.xerial.snappy","virtualPath":"/usr/share/java/kafka/snappy-java-1.1.10.5.jar","manifestName":"","pomArtifactID":"snappy-java","archiveDigests":[{"value":"ac605269f3598506196e469f1fb0d7ed5c55059e","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/snappy-java-1.1.10.5.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/snappy-java-1.1.10.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.10.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q233-g92q-qxp6","versionConstraint":"<=1.1.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.xerial.snappy:snappy-java","version":"1.1.10.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q233-g92q-qxp6","fix":{"state":"fixed","versions":["1.1.10.9"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"1.1.10.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-108106","cwe":"CWE-789","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-108106","date":"2026-11-07","epss":0.00371,"percentile":0.31262}],"risk":0.27825,"urls":["https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6","https://nvd.nist.gov/vuln/detail/CVE-2026-108106","https://github.com/xerial/snappy-java/pull/739","https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75","https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517","https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9","https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q233-g92q-qxp6","description":"snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha"},"relatedVulnerabilities":[{"id":"CVE-2026-108106","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-108106","cwe":"CWE-789","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-108106","date":"2026-11-07","epss":0.00371,"percentile":0.31262}],"urls":["https://github.com/xerial/snappy-java","https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517","https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75","https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9","https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6","https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-108106","description":"Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service."}]},{"artifact":{"id":"1775c26714af39c8","cpes":["cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy:1.1.10.5:*:*:*:*:*:*:*"],"name":"snappy-java","purl":"pkg:maven/org.xerial.snappy/snappy-java@1.1.10.5","type":"java-archive","version":"1.1.10.5","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.xerial.snappy","virtualPath":"/usr/share/java/cp-base-new/snappy-java-1.1.10.5.jar","manifestName":"","pomArtifactID":"snappy-java","archiveDigests":[{"value":"ac605269f3598506196e469f1fb0d7ed5c55059e","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/snappy-java-1.1.10.5.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/snappy-java-1.1.10.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.10.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q233-g92q-qxp6","versionConstraint":"<=1.1.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.xerial.snappy:snappy-java","version":"1.1.10.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q233-g92q-qxp6","fix":{"state":"fixed","versions":["1.1.10.9"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"1.1.10.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-108106","cwe":"CWE-789","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-108106","date":"2026-11-07","epss":0.00371,"percentile":0.31262}],"risk":0.27825,"urls":["https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6","https://nvd.nist.gov/vuln/detail/CVE-2026-108106","https://github.com/xerial/snappy-java/pull/739","https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75","https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517","https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9","https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q233-g92q-qxp6","description":"snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha"},"relatedVulnerabilities":[{"id":"CVE-2026-108106","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-108106","cwe":"CWE-789","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-108106","date":"2026-11-07","epss":0.00371,"percentile":0.31262}],"urls":["https://github.com/xerial/snappy-java","https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517","https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75","https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9","https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6","https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-108106","description":"Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":2.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-07","epss":0.00828,"percentile":0.57737}],"risk":0.27737999999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-87864","description":"A flaw was found in curl. When curl is configured to perform carriage return and line feed (CRLF) conversion during an Internet Message Access Protocol (IMAP) append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the advertised length as message data, it interprets the remaining overflow bytes as subsequent commands. An attacker capable of supplying message data with line breaks can exploit this issue to execute unauthorized IMAP commands within an authenticated session."},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-07","epss":0.00828,"percentile":0.57737}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":2.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-07","epss":0.00828,"percentile":0.57737}],"risk":0.27737999999999996,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-87864","description":"A flaw was found in curl. When curl is configured to perform carriage return and line feed (CRLF) conversion during an Internet Message Access Protocol (IMAP) append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the advertised length as message data, it interprets the remaining overflow bytes as subsequent commands. An attacker capable of supplying message data with line breaks can exploit this issue to execute unauthorized IMAP commands within an authenticated session."},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-07","epss":0.00828,"percentile":0.57737}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"e91578fe83af8db0","cpes":["cpe:2.3:a:xz-libs:xz-libs:5.2.4-4.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:xz-libs:xz_libs:5.2.4-4.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:xz_libs:xz-libs:5.2.4-4.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:xz_libs:xz_libs:5.2.4-4.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:xz-libs:5.2.4-4.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:xz_libs:5.2.4-4.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:xz:xz-libs:5.2.4-4.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:xz:xz_libs:5.2.4-4.el8_6:*:*:*:*:*:*:*"],"name":"xz-libs","purl":"pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=rhel-8.10&upstream=xz-5.2.4-4.el8_6.src.rpm","type":"rpm","version":"5.2.4-4.el8_6","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"xz","version":"5.2.4-4.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34743","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"xz","version":"5.2.4-4.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-34743","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34743","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34743","date":"2026-11-07","epss":0.00534,"percentile":0.45338}],"risk":0.27501000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-34743","description":"A flaw was found in XZ Utils. When the `lzma_index_decoder()` function processes an empty index, and a subsequent `lzma_index_append()` operation is performed, insufficient memory is allocated. This can lead to a buffer overflow, potentially causing a denial of service (DoS) for affected systems."},"relatedVulnerabilities":[{"id":"CVE-2026-34743","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34743","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34743","date":"2026-11-07","epss":0.00534,"percentile":0.45338}],"urls":["https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87","https://github.com/tukaani-project/xz/releases/tag/v5.8.3","https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv","http://www.openwall.com/lists/oss-security/2026/03/31/13","https://lists.debian.org/debian-lts-announce/2026/07/msg00034.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34743","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3."}]},{"artifact":{"id":"e390c65fcc1c5000","cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@2.7.0","type":"python","version":"2.7.0","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/METADATA","layerID":"sha256:ee08bcd61791d94f87a8872f390618ce45e47cf924c4292d57689eff006b1944","accessPath":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/RECORD","layerID":"sha256:ee08bcd61791d94f87a8872f390618ce45e47cf924c4292d57689eff006b1944","accessPath":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/RECORD","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vxq7-64xx-v4gw","versionConstraint":">=1.10.3,<2.8.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"2.7.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-vxq7-64xx-v4gw","fix":{"state":"fixed","versions":["2.8.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97689","date":"2026-11-07","epss":0.00335,"percentile":0.26984}],"risk":0.27470000000000006,"urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vxq7-64xx-v4gw","description":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory"},"relatedVulnerabilities":[{"id":"CVE-2026-97689","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97689","date":"2026-11-07","epss":0.00335,"percentile":0.26984}],"urls":["https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689","description":"urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0."}]},{"artifact":{"id":"93eed475e569196b","cpes":["cpe:2.3:a:platform-python-pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python-pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"platform-python-pip","purl":"pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-45803","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-45803","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.2,"impactScore":3.6,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45803","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-45803","date":"2026-11-07","epss":0.00593,"percentile":0.48587}],"risk":0.27278,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-45803","description":"A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as `POST` to `GET`, as is required by HTTP RFCs. This issue requires a previously trusted service to become compromised in order to have an impact on confidentiality, therefore, the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies; if this is the case, this vulnerability isn't exploitable."},"relatedVulnerabilities":[{"id":"CVE-2023-45803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.2,"impactScore":3.6,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.2,"impactScore":3.6,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45803","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-45803","date":"2026-11-07","epss":0.00593,"percentile":0.48587}],"urls":["https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9","https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/","https://www.rfc-editor.org/rfc/rfc9110.html#name-get","https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45803","description":"urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body."}]},{"artifact":{"id":"fa83cdeeda4e9e6a","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-45803","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-45803","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.2,"impactScore":3.6,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45803","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-45803","date":"2026-11-07","epss":0.00593,"percentile":0.48587}],"risk":0.27278,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-45803","description":"A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as `POST` to `GET`, as is required by HTTP RFCs. This issue requires a previously trusted service to become compromised in order to have an impact on confidentiality, therefore, the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies; if this is the case, this vulnerability isn't exploitable."},"relatedVulnerabilities":[{"id":"CVE-2023-45803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.2,"impactScore":3.6,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.2,"impactScore":3.6,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45803","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-45803","date":"2026-11-07","epss":0.00593,"percentile":0.48587}],"urls":["https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9","https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/","https://www.rfc-editor.org/rfc/rfc9110.html#name-get","https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45803","description":"urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-75804","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-75804","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-11-07","epss":0.00529,"percentile":0.45015}],"risk":0.27243500000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75804","description":"A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can force the system to buffer far more data than permitted by the connection limit. This excessive memory allocation can exhaust available system resources and degrade or terminate the service."},"relatedVulnerabilities":[{"id":"CVE-2026-75804","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-11-07","epss":0.00529,"percentile":0.45015}],"urls":["https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e","https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538","https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a","https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75804","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-75804","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-11-07","epss":0.00529,"percentile":0.45015}],"risk":0.27243500000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-75804","description":"A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can force the system to buffer far more data than permitted by the connection limit. This excessive memory allocation can exhaust available system resources and degrade or terminate the service."},"relatedVulnerabilities":[{"id":"CVE-2026-75804","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75804","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75804","date":"2026-11-07","epss":0.00529,"percentile":0.45015}],"urls":["https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e","https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538","https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a","https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75804","description":"Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"3daf927dec9eda42","cpes":["cpe:2.3:a:gnutls:gnutls:3.6.16-8.el8_10.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.6.16-8.el8_10.6:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=rhel-8.10&upstream=gnutls-3.6.16-8.el8_10.6.src.rpm","type":"rpm","version":"3.6.16-8.el8_10.6","language":"","licenses":["GPLv3+ and LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-3832","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gnutls","version":"0:3.6.16-8.el8_10.6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-3832","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3832","cwe":"CWE-179","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3832","date":"2026-11-07","epss":0.00804,"percentile":0.56974}],"risk":0.26933999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3832","description":"A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust."},"relatedVulnerabilities":[{"id":"CVE-2026-3832","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3832","cwe":"CWE-179","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3832","date":"2026-11-07","epss":0.00804,"percentile":0.56974}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-3832","https://bugzilla.redhat.com/show_bug.cgi?id=2445762","https://gitlab.com/gnutls/gnutls/-/issues/1801"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3832","description":"A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust."}]},{"artifact":{"id":"9596d540aa4016c7","cpes":["cpe:2.3:a:redhat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-2.el8_10.2?arch=x86_64&distro=rhel-8.10&upstream=expat-2.5.0-2.el8_10.2.src.rpm","type":"rpm","version":"2.5.0-2.el8_10.2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-113351","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"expat","version":"0:2.5.0-2.el8_10.2"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-113351","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-07","epss":0.00494,"percentile":0.42653}],"risk":0.26923,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-113351","description":"A flaw was found in expat. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a large XML document to an application that reuses parser instances. When the XML parser is reset using XML_ParserReset, it clears the direct byte count but fails to offset tracked heap allocations. Consequently, subsequent parsing operations on the reused parser fail with out-of-memory errors until the parser is completely recreated."},"relatedVulnerabilities":[{"id":"CVE-2026-113351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-07","epss":0.00494,"percentile":0.42653}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884","https://github.com/libexpat/libexpat/pull/1431","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-3783","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-3783","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3783","date":"2026-11-07","epss":0.00495,"percentile":0.427}],"risk":0.26482500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3783","description":"A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3783","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3783","date":"2026-11-07","epss":0.00495,"percentile":0.427}],"urls":["https://curl.se/docs/CVE-2026-3783.html","https://curl.se/docs/CVE-2026-3783.json","https://hackerone.com/reports/3583983","http://www.openwall.com/lists/oss-security/2026/03/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3783","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-3783","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3783","date":"2026-11-07","epss":0.00495,"percentile":0.427}],"risk":0.26482500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3783","description":"A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3783","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3783","date":"2026-11-07","epss":0.00495,"percentile":0.427}],"urls":["https://curl.se/docs/CVE-2026-3783.html","https://curl.se/docs/CVE-2026-3783.json","https://hackerone.com/reports/3583983","http://www.openwall.com/lists/oss-security/2026/03/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one."}]},{"artifact":{"id":"9596d540aa4016c7","cpes":["cpe:2.3:a:redhat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-2.el8_10.2?arch=x86_64&distro=rhel-8.10&upstream=expat-2.5.0-2.el8_10.2.src.rpm","type":"rpm","version":"2.5.0-2.el8_10.2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76641","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"expat","version":"0:2.5.0-2.el8_10.2"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-76641","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76641","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76641","date":"2026-11-07","epss":0.00353,"percentile":0.29202}],"risk":0.26475,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-76641","description":"A flaw was found in Expat. Attackers can exploit an out-of-bounds read vulnerability by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. This can lead to memory corruption. Specifically, a mismatch in struct sizes can cause a read past memory boundaries, potentially resulting in a denial of service (DoS) due to a segfault or incorrect handling of XML attributes."},"relatedVulnerabilities":[{"id":"CVE-2026-76641","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76641","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76641","date":"2026-11-07","epss":0.00353,"percentile":0.29202}],"urls":["https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf","https://github.com/libexpat/libexpat/pull/1331","https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76641","description":"Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3644","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-3644","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-11-07","epss":0.00508,"percentile":0.43641}],"risk":0.26416000000000006,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3644","description":"A control character validation flaw has been discovered in the Python http.cookie module. The Morsel.update(), |= operator, and unpickling paths were not patched to resolve  CVE-2026-0672, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output()."},"relatedVulnerabilities":[{"id":"CVE-2026-3644","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-11-07","epss":0.00508,"percentile":0.43641}],"urls":["https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330","https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8","https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4","https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd","https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd","https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef","https://github.com/python/cpython/issues/145599","https://github.com/python/cpython/pull/145600","https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3644","description":"The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output()."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3644","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-3644","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-11-07","epss":0.00508,"percentile":0.43641}],"risk":0.26416000000000006,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3644","description":"A control character validation flaw has been discovered in the Python http.cookie module. The Morsel.update(), |= operator, and unpickling paths were not patched to resolve  CVE-2026-0672, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output()."},"relatedVulnerabilities":[{"id":"CVE-2026-3644","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3644","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-3644","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3644","date":"2026-11-07","epss":0.00508,"percentile":0.43641}],"urls":["https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330","https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8","https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4","https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd","https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd","https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef","https://github.com/python/cpython/issues/145599","https://github.com/python/cpython/pull/145600","https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3644","description":"The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output()."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15282","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-15282","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.8,"impactScore":3.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-11-07","epss":0.00537,"percentile":0.45505}],"risk":0.26313000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15282","description":"Missing newline filtering has been discovered in Python. User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype."},"relatedVulnerabilities":[{"id":"CVE-2025-15282","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-11-07","epss":0.00537,"percentile":0.45505}],"urls":["https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0","https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38","https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80","https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47","https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a","https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f","https://github.com/python/cpython/issues/143925","https://github.com/python/cpython/pull/143926","https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15282","description":"User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15282","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-15282","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.8,"impactScore":3.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-11-07","epss":0.00537,"percentile":0.45505}],"risk":0.26313000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15282","description":"Missing newline filtering has been discovered in Python. User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype."},"relatedVulnerabilities":[{"id":"CVE-2025-15282","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15282","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15282","date":"2026-11-07","epss":0.00537,"percentile":0.45505}],"urls":["https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0","https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38","https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80","https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47","https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a","https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f","https://github.com/python/cpython/issues/143925","https://github.com/python/cpython/pull/143926","https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15282","description":"User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-22796","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-22796","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22796","date":"2026-11-07","epss":0.00589,"percentile":0.48395}],"risk":0.2621050000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-22796","description":"A flaw was found in OpenSSL. This type confusion vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted PKCS#7 data to an application that performs signature verification. The vulnerability occurs because the application accesses an ASN1_TYPE union member without proper type validation, leading to an invalid or NULL pointer dereference and a crash."},"relatedVulnerabilities":[{"id":"CVE-2026-22796","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22796","date":"2026-11-07","epss":0.00589,"percentile":0.48395}],"urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","description":"Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-22796","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-22796","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22796","date":"2026-11-07","epss":0.00589,"percentile":0.48395}],"risk":0.2621050000000001,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-22796","description":"A flaw was found in OpenSSL. This type confusion vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted PKCS#7 data to an application that performs signature verification. The vulnerability occurs because the application accesses an ASN1_TYPE union member without proper type validation, leading to an invalid or NULL pointer dereference and a crash."},"relatedVulnerabilities":[{"id":"CVE-2026-22796","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22796","date":"2026-11-07","epss":0.00589,"percentile":0.48395}],"urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","description":"Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}]},{"artifact":{"id":"55281a0c21c596b7","cpes":["cpe:2.3:a:redhat:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=rhel-8.10&epoch=2&upstream=tar-1.30-11.el8_10.src.rpm","type":"rpm","version":"2:1.30-11.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2:1.30-13.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-45582","versionConstraint":"< 2:1.30-13.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"tar","version":"2:1.30-11.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-45582","fix":{"state":"fixed","versions":["2:1.30-13.el8_10"],"available":[{"date":"2026-09-23","kind":"first-observed","version":"2:1.30-13.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-45582","cwe":"CWE-24","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-45582","date":"2026-11-07","epss":0.0049,"percentile":0.42396}],"risk":0.2597,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:70390","link":"https://access.redhat.com/errata/RHSA-2026:70390"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-45582","description":"A flaw was found in GNU Tar. An attacker could exploit this vulnerability by providing two specially crafted TAR archives, if those archives were extracted in the same directory. The first archive contains a symbolic link that points to a critical directory. The second archive, when extracted, uses this symbolic link to overwrite sensitive files on the system, bypassing existing directory traversal protections. This could lead to unauthorized file modification or, in some cases, privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2025-45582","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L","metrics":{"baseScore":4.1,"impactScore":2.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-45582","cwe":"CWE-24","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-45582","date":"2026-11-07","epss":0.0049,"percentile":0.42396}],"urls":["https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md","https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html","https://www.gnu.org/software/tar/","https://www.gnu.org/software/tar/manual/html_node/Integrity.html","https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html","http://www.openwall.com/lists/oss-security/2025/11/01/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-45582","description":"GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of \"Member name contains '..'\" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain \"x -> ../../../../../home/victim/.ssh\" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which \"tar xf\" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each \"tar xf\" in its Security Rules of Thumb; however, third-party advice leads users to run \"tar xf\" more than once into the same directory."}]},{"artifact":{"id":"af4525477ddde7ef","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=rhel-8.10&upstream=krb5-1.18.2-34.el8_10.src.rpm","type":"rpm","version":"1.18.2-34.el8_10","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.18.2-34.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"krb5","version":"1.18.2-34.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-07","epss":0.00521,"percentile":0.4447}],"risk":0.257895,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107708","description":"A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center (KDC) to cause a Denial of Service (DoS). By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate (PAC), an attacker can trigger a NULL pointer dereference that crashes the KDC daemon, interrupting authentication services."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-07","epss":0.00521,"percentile":0.4447}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"797a0e1b827791c1","cpes":["cpe:2.3:a:krb5-workstation:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5-workstation:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_workstation:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_workstation:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*"],"name":"krb5-workstation","purl":"pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=rhel-8.10&upstream=krb5-1.18.2-34.el8_10.src.rpm","type":"rpm","version":"1.18.2-34.el8_10","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.18.2-34.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"krb5","version":"1.18.2-34.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-07","epss":0.00521,"percentile":0.4447}],"risk":0.257895,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107708","description":"A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center (KDC) to cause a Denial of Service (DoS). By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate (PAC), an attacker can trigger a NULL pointer dereference that crashes the KDC daemon, interrupting authentication services."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-07","epss":0.00521,"percentile":0.4447}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"4f954c6e0eab6dee","cpes":["cpe:2.3:a:libkadm5:libkadm5:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libkadm5:1.18.2-34.el8_10:*:*:*:*:*:*:*"],"name":"libkadm5","purl":"pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=rhel-8.10&upstream=krb5-1.18.2-34.el8_10.src.rpm","type":"rpm","version":"1.18.2-34.el8_10","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.18.2-34.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"krb5","version":"1.18.2-34.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-07","epss":0.00521,"percentile":0.4447}],"risk":0.257895,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107708","description":"A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center (KDC) to cause a Denial of Service (DoS). By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate (PAC), an attacker can trigger a NULL pointer dereference that crashes the KDC daemon, interrupting authentication services."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-07","epss":0.00521,"percentile":0.4447}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-3784","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-3784","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3784","date":"2026-11-07","epss":0.00448,"percentile":0.39194}],"risk":0.2576,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3784","description":"A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker gaining unauthorized access to resources or information intended for a different user."},"relatedVulnerabilities":[{"id":"CVE-2026-3784","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3784","date":"2026-11-07","epss":0.00448,"percentile":0.39194}],"urls":["https://curl.se/docs/CVE-2026-3784.html","https://curl.se/docs/CVE-2026-3784.json","https://hackerone.com/reports/3584903","http://www.openwall.com/lists/oss-security/2026/03/11/3","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3784","description":"curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3784","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-3784","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3784","date":"2026-11-07","epss":0.00448,"percentile":0.39194}],"risk":0.2576,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3784","description":"A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker gaining unauthorized access to resources or information intended for a different user."},"relatedVulnerabilities":[{"id":"CVE-2026-3784","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3784","date":"2026-11-07","epss":0.00448,"percentile":0.39194}],"urls":["https://curl.se/docs/CVE-2026-3784.html","https://curl.se/docs/CVE-2026-3784.json","https://hackerone.com/reports/3584903","http://www.openwall.com/lists/oss-security/2026/03/11/3","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3784","description":"curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-9545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-11-07","epss":0.00408,"percentile":0.35327}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9545","description":"A flaw was found in libcurl. An attacker can exploit this by replacing a legitimate HTTP/3 server with an impostor machine. When libcurl attempts a second transfer to the same site with a cached SSL session and early data enabled, it may send sensitive request data before verifying the server's certificate. This could lead to the disclosure of sensitive information to the attacker."},"relatedVulnerabilities":[{"id":"CVE-2026-9545","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-11-07","epss":0.00408,"percentile":0.35327}],"urls":["https://curl.se/docs/CVE-2026-9545.html","https://curl.se/docs/CVE-2026-9545.json","https://hackerone.com/reports/3752888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-9545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-11-07","epss":0.00408,"percentile":0.35327}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9545","description":"A flaw was found in libcurl. An attacker can exploit this by replacing a legitimate HTTP/3 server with an impostor machine. When libcurl attempts a second transfer to the same site with a cached SSL session and early data enabled, it may send sensitive request data before verifying the server's certificate. This could lead to the disclosure of sensitive information to the attacker."},"relatedVulnerabilities":[{"id":"CVE-2026-9545","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-11-07","epss":0.00408,"percentile":0.35327}],"urls":["https://curl.se/docs/CVE-2026-9545.html","https://curl.se/docs/CVE-2026-9545.json","https://hackerone.com/reports/3752888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1502","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-1502","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.5,"impactScore":3.6,"exploitabilityScore":1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-11-07","epss":0.00535,"percentile":0.45363}],"risk":0.254125,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1502","description":"A flaw was found in Python. This vulnerability allows for the injection of extra information into HTTP communication. Specifically, the system does not properly prevent special characters (carriage return and line feed) from being included in HTTP client proxy tunnel headers or host fields."},"relatedVulnerabilities":[{"id":"CVE-2026-1502","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-11-07","epss":0.00535,"percentile":0.45363}],"urls":["https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69","https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53","https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3e","https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8dd","https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed","https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ec","https://github.com/python/cpython/issues/146211","https://github.com/python/cpython/pull/146212","https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/","http://www.openwall.com/lists/oss-security/2026/04/11/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1502","description":"CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1502","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-1502","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.5,"impactScore":3.6,"exploitabilityScore":1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-11-07","epss":0.00535,"percentile":0.45363}],"risk":0.254125,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1502","description":"A flaw was found in Python. This vulnerability allows for the injection of extra information into HTTP communication. Specifically, the system does not properly prevent special characters (carriage return and line feed) from being included in HTTP client proxy tunnel headers or host fields."},"relatedVulnerabilities":[{"id":"CVE-2026-1502","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1502","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1502","date":"2026-11-07","epss":0.00535,"percentile":0.45363}],"urls":["https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69","https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53","https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3e","https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8dd","https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed","https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ec","https://github.com/python/cpython/issues/146211","https://github.com/python/cpython/pull/146212","https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/","http://www.openwall.com/lists/oss-security/2026/04/11/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1502","description":"CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host."}]},{"artifact":{"id":"9596d540aa4016c7","cpes":["cpe:2.3:a:redhat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-2.el8_10.2?arch=x86_64&distro=rhel-8.10&upstream=expat-2.5.0-2.el8_10.2.src.rpm","type":"rpm","version":"2.5.0-2.el8_10.2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.5.0-6.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"< 0:2.5.0-6.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"expat","version":"0:2.5.0-2.el8_10.2"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"fixed","versions":["0:2.5.0-6.el8_10"],"available":[{"date":"2026-10-31","kind":"first-observed","version":"0:2.5.0-6.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-11-07","epss":0.0032,"percentile":0.25092}],"risk":0.2512,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92323","link":"https://access.redhat.com/errata/RHSA-2026:92323"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77214","description":"A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist in bypassing security mitigations such as Address Space Layout Randomization (ASLR), or result in a Denial of Service (DoS) by crashing the application."},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-11-07","epss":0.0032,"percentile":0.25092}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3276","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-3276","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-11-07","epss":0.00486,"percentile":0.42114}],"risk":0.25028999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3276","description":"A flaw was found in the `unicodedata.normalize()` function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service (DoS) on the affected system."},"relatedVulnerabilities":[{"id":"CVE-2026-3276","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-11-07","epss":0.00486,"percentile":0.42114}],"urls":["https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0","https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598","https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f","https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32","https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066","https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f","https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc","https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c","https://github.com/python/cpython/issues/149079","https://github.com/python/cpython/pull/149080","https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/","http://www.openwall.com/lists/oss-security/2026/06/03/15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3276","description":"unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3276","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-3276","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-11-07","epss":0.00486,"percentile":0.42114}],"risk":0.25028999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-3276","description":"A flaw was found in the `unicodedata.normalize()` function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service (DoS) on the affected system."},"relatedVulnerabilities":[{"id":"CVE-2026-3276","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3276","cwe":"CWE-407","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-3276","date":"2026-11-07","epss":0.00486,"percentile":0.42114}],"urls":["https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0","https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598","https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f","https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32","https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066","https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f","https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc","https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c","https://github.com/python/cpython/issues/149079","https://github.com/python/cpython/pull/149080","https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/","http://www.openwall.com/lists/oss-security/2026/06/03/15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3276","description":"unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms."}]},{"artifact":{"id":"2dd3466fcbd5ba1b","cpes":["cpe:2.3:a:jline-builtins:jline-builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline-builtins:jline_builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline-builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline_builtins:jline_builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline-builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:org.jline:jline_builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline-builtins:3.25.1:*:*:*:*:*:*:*","cpe:2.3:a:jline:jline_builtins:3.25.1:*:*:*:*:*:*:*"],"name":"jline-builtins","purl":"pkg:maven/org.jline/jline-builtins@3.25.1","type":"java-archive","version":"3.25.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.jline","virtualPath":"/usr/share/java/kafka/jline-3.25.1.jar:org.jline:jline-builtins","manifestName":"","pomArtifactID":"jline-builtins","archiveDigests":null},"locations":[{"path":"/usr/share/java/kafka/jline-3.25.1.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/jline-3.25.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.30.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ph9c-7hw9-vhhw","versionConstraint":">=3.0.0,<3.30.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jline:jline-builtins","version":"3.25.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ph9c-7hw9-vhhw","fix":{"state":"fixed","versions":["3.30.15"],"available":[{"date":"2026-09-24","kind":"first-observed","version":"3.30.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77421","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77421","date":"2026-11-07","epss":0.00434,"percentile":0.3792}],"risk":0.24955,"urls":["https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ph9c-7hw9-vhhw","description":"JLine: ReDoS in Nano Editor Regex Search Mode"},"relatedVulnerabilities":[{"id":"CVE-2026-77421","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77421","cwe":"CWE-1333","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77421","date":"2026-11-07","epss":0.00434,"percentile":0.3792}],"urls":["https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","https://github.com/jline/jline3/pull/2012","https://github.com/jline/jline3/pull/2018","https://github.com/jline/jline3/releases/tag/4.3.1","https://github.com/jline/jline3/releases/tag/jline-3.30.15","https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77421","description":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80225","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-80225","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80225","cwe":"CWE-770","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-80225","date":"2026-11-07","epss":0.00482,"percentile":0.41805}],"risk":0.24822999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80225","description":"A flaw was found in Unbound. A malicious actor can exploit a vulnerability in the TCP/DoT reading procedure, which lacks a limit on consecutive reads. By continuously streaming distinct uncached names over a TCP/DoT connection, an attacker can monopolize a worker's event loop. This can lead to a degradation of service, effectively causing a Denial of Service (DoS) for legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-80225","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80225","cwe":"CWE-770","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-80225","date":"2026-11-07","epss":0.00482,"percentile":0.41805}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80225","description":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85501","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-85501","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85501","cwe":"CWE-770","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-85501","date":"2026-11-07","epss":0.00482,"percentile":0.41805}],"risk":0.24822999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-85501","description":"A flaw was found in Unbound. This vulnerability, termed 'ReTrap', allows a remote attacker to launch algorithmic complexity attacks on the Domain Name System Security Extensions (DNSSEC) validation process. By serving malicious zones or responses, an attacker can exploit various mechanisms, such as mismatched DNSKEY records, deeply nested domains, or excessive invalid NSEC records. Successful exploitation leads to a degradation of service, effectively causing a Denial of Service (DoS) for affected Unbound resolvers."},"relatedVulnerabilities":[{"id":"CVE-2026-85501","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85501","cwe":"CWE-770","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-85501","date":"2026-11-07","epss":0.00482,"percentile":0.41805}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85501","description":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80225","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-80225","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80225","cwe":"CWE-770","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-80225","date":"2026-11-07","epss":0.00482,"percentile":0.41805}],"risk":0.24822999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80225","description":"A flaw was found in Unbound. A malicious actor can exploit a vulnerability in the TCP/DoT reading procedure, which lacks a limit on consecutive reads. By continuously streaming distinct uncached names over a TCP/DoT connection, an attacker can monopolize a worker's event loop. This can lead to a degradation of service, effectively causing a Denial of Service (DoS) for legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-80225","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80225","cwe":"CWE-770","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-80225","date":"2026-11-07","epss":0.00482,"percentile":0.41805}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80225","description":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85501","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-85501","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85501","cwe":"CWE-770","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-85501","date":"2026-11-07","epss":0.00482,"percentile":0.41805}],"risk":0.24822999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-85501","description":"A flaw was found in Unbound. This vulnerability, termed 'ReTrap', allows a remote attacker to launch algorithmic complexity attacks on the Domain Name System Security Extensions (DNSSEC) validation process. By serving malicious zones or responses, an attacker can exploit various mechanisms, such as mismatched DNSKEY records, deeply nested domains, or excessive invalid NSEC records. Successful exploitation leads to a degradation of service, effectively causing a Denial of Service (DoS) for affected Unbound resolvers."},"relatedVulnerabilities":[{"id":"CVE-2026-85501","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85501","cwe":"CWE-770","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-85501","date":"2026-11-07","epss":0.00482,"percentile":0.41805}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85501","description":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-13176","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-13176","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-11-07","epss":0.00644,"percentile":0.51146}],"risk":0.24794000000000002,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-13176","description":"A timing side-channel vulnerability was found in OpenSSL. This vulnerability allows an attacker to recover the private key. However, measuring the timing would require local access to the signing application or a fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This issue can happen with significant probability only for some of the supported elliptic curves. In particular, the NIST P-521 curve is affected."},"relatedVulnerabilities":[{"id":"CVE-2024-13176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.6,"impactScore":3.6,"exploitabilityScore":1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-11-07","epss":0.00644,"percentile":0.51146}],"urls":["https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844","https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467","https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902","https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65","https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f","https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded","https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86","https://openssl-library.org/news/secadv/20250120.txt","http://www.openwall.com/lists/oss-security/2025/01/20/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html","https://security.netapp.com/advisory/ntap-20250124-0005/","https://security.netapp.com/advisory/ntap-20250418-0010/","https://security.netapp.com/advisory/ntap-20250502-0006/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-13176","description":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-13176","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-13176","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-11-07","epss":0.00644,"percentile":0.51146}],"risk":0.24794000000000002,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-13176","description":"A timing side-channel vulnerability was found in OpenSSL. This vulnerability allows an attacker to recover the private key. However, measuring the timing would require local access to the signing application or a fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This issue can happen with significant probability only for some of the supported elliptic curves. In particular, the NIST P-521 curve is affected."},"relatedVulnerabilities":[{"id":"CVE-2024-13176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.6,"impactScore":3.6,"exploitabilityScore":1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-11-07","epss":0.00644,"percentile":0.51146}],"urls":["https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844","https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467","https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902","https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65","https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f","https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded","https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86","https://openssl-library.org/news/secadv/20250120.txt","http://www.openwall.com/lists/oss-security/2025/01/20/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html","https://security.netapp.com/advisory/ntap-20250124-0005/","https://security.netapp.com/advisory/ntap-20250418-0010/","https://security.netapp.com/advisory/ntap-20250502-0006/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-13176","description":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:7.61.1-34.el8_10.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8932","versionConstraint":"< 0:7.61.1-34.el8_10.18 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-8932","fix":{"state":"fixed","versions":["0:7.61.1-34.el8_10.18"],"available":[{"date":"2026-10-30","kind":"first-observed","version":"0:7.61.1-34.el8_10.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-11-07","epss":0.00396,"percentile":0.34086}],"risk":0.24749999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92368","link":"https://access.redhat.com/errata/RHSA-2026:92368"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8932","description":"A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data."},"relatedVulnerabilities":[{"id":"CVE-2026-8932","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-11-07","epss":0.00396,"percentile":0.34086}],"urls":["https://curl.se/docs/CVE-2026-8932.html","https://curl.se/docs/CVE-2026-8932.json","https://hackerone.com/reports/3733910"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","description":"libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:7.61.1-34.el8_10.18"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8932","versionConstraint":"< 0:7.61.1-34.el8_10.18 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-8932","fix":{"state":"fixed","versions":["0:7.61.1-34.el8_10.18"],"available":[{"date":"2026-10-30","kind":"first-observed","version":"0:7.61.1-34.el8_10.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-11-07","epss":0.00396,"percentile":0.34086}],"risk":0.24749999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92368","link":"https://access.redhat.com/errata/RHSA-2026:92368"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8932","description":"A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data."},"relatedVulnerabilities":[{"id":"CVE-2026-8932","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-11-07","epss":0.00396,"percentile":0.34086}],"urls":["https://curl.se/docs/CVE-2026-8932.html","https://curl.se/docs/CVE-2026-8932.json","https://hackerone.com/reports/3733910"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","description":"libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key."}]},{"artifact":{"id":"538aee4e6c401b2e","cpes":["cpe:2.3:a:ca-certificates:ca-certificates:2025.2.80_v9.0.304-80.2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:ca-certificates:ca_certificates:2025.2.80_v9.0.304-80.2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:ca_certificates:ca-certificates:2025.2.80_v9.0.304-80.2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:ca_certificates:ca_certificates:2025.2.80_v9.0.304-80.2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ca-certificates:2025.2.80_v9.0.304-80.2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:ca_certificates:2025.2.80_v9.0.304-80.2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:ca:ca-certificates:2025.2.80_v9.0.304-80.2.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:ca:ca_certificates:2025.2.80_v9.0.304-80.2.el8_10:*:*:*:*:*:*:*"],"name":"ca-certificates","purl":"pkg:rpm/redhat/ca-certificates@2025.2.80_v9.0.304-80.2.el8_10?arch=noarch&distro=rhel-8.10&upstream=ca-certificates-2025.2.80_v9.0.304-80.2.el8_10.src.rpm","type":"rpm","version":"2025.2.80_v9.0.304-80.2.el8_10","language":"","licenses":["MIT AND GPL-2.0-or-later"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2026.2.92_v9.0.319-81.3.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114406","versionConstraint":"< 0:2026.2.92_v9.0.319-81.3.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"ca-certificates","version":"0:2025.2.80_v9.0.304-80.2.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-114406","fix":{"state":"fixed","versions":["0:2026.2.92_v9.0.319-81.3.el8_10"],"available":[{"date":"2026-10-23","kind":"first-observed","version":"0:2026.2.92_v9.0.319-81.3.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114406","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114406","date":"2026-11-07","epss":0.0031,"percentile":0.23986}],"risk":0.24490000000000003,"urls":[],"severity":"Critical","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:88550","link":"https://access.redhat.com/errata/RHSA-2026:88550"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-114406","description":"The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed."},"relatedVulnerabilities":[{"id":"CVE-2026-114406","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114406","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114406","date":"2026-11-07","epss":0.0031,"percentile":0.23986}],"urls":["https://access.redhat.com/errata/RHSA-2026:86595","https://access.redhat.com/errata/RHSA-2026:88455","https://access.redhat.com/errata/RHSA-2026:88459","https://access.redhat.com/errata/RHSA-2026:88550","https://access.redhat.com/errata/RHSA-2026:88560","https://access.redhat.com/errata/RHSA-2026:88562","https://access.redhat.com/errata/RHSA-2026:88563","https://access.redhat.com/errata/RHSA-2026:88564","https://access.redhat.com/errata/RHSA-2026:88662","https://access.redhat.com/errata/RHSA-2026:88668","https://access.redhat.com/errata/RHSA-2026:88669","https://access.redhat.com/errata/RHSA-2026:88779","https://access.redhat.com/errata/RHSA-2026:89081","https://access.redhat.com/errata/RHSA-2026:89131","https://access.redhat.com/errata/RHSA-2026:89197","https://access.redhat.com/errata/RHSA-2026:89232","https://access.redhat.com/errata/RHSA-2026:89333","https://access.redhat.com/errata/RHSA-2026:89651","https://access.redhat.com/errata/RHSA-2026:89714","https://access.redhat.com/errata/RHSA-2026:89725","https://access.redhat.com/errata/RHSA-2026:89838","https://access.redhat.com/errata/RHSA-2026:89907","https://access.redhat.com/errata/RHSA-2026:90272","https://access.redhat.com/errata/RHSA-2026:90969","https://access.redhat.com/errata/RHSA-2026:90985","https://access.redhat.com/errata/RHSA-2026:91202","https://access.redhat.com/errata/RHSA-2026:91204","https://access.redhat.com/errata/RHSA-2026:91206","https://access.redhat.com/errata/RHSA-2026:91207","https://access.redhat.com/errata/RHSA-2026:91217","https://access.redhat.com/errata/RHSA-2026:91218","https://access.redhat.com/errata/RHSA-2026:91219","https://access.redhat.com/errata/RHSA-2026:91224","https://access.redhat.com/errata/RHSA-2026:91232","https://access.redhat.com/errata/RHSA-2026:91233","https://access.redhat.com/errata/RHSA-2026:91234","https://access.redhat.com/errata/RHSA-2026:91235","https://access.redhat.com/errata/RHSA-2026:91236","https://access.redhat.com/errata/RHSA-2026:91237","https://access.redhat.com/errata/RHSA-2026:91238","https://access.redhat.com/errata/RHSA-2026:91241","https://access.redhat.com/errata/RHSA-2026:91242","https://access.redhat.com/errata/RHSA-2026:91243","https://access.redhat.com/errata/RHSA-2026:91244","https://access.redhat.com/errata/RHSA-2026:91245","https://access.redhat.com/errata/RHSA-2026:91246","https://access.redhat.com/errata/RHSA-2026:91248","https://access.redhat.com/errata/RHSA-2026:91249","https://access.redhat.com/errata/RHSA-2026:91997","https://access.redhat.com/errata/RHSA-2026:92006","https://access.redhat.com/errata/RHSA-2026:92342","https://access.redhat.com/errata/RHSA-2026:93043","https://access.redhat.com/errata/RHSA-2026:93044","https://access.redhat.com/errata/RHSA-2026:93045","https://access.redhat.com/errata/RHSA-2026:93046","https://access.redhat.com/errata/RHSA-2026:94459","https://access.redhat.com/errata/RHSA-2026:94468","https://access.redhat.com/errata/RHSA-2026:94474","https://access.redhat.com/errata/RHSA-2026:94476","https://access.redhat.com/errata/RHSA-2026:94562","https://access.redhat.com/errata/RHSA-2026:94581","https://access.redhat.com/errata/RHSA-2026:94583","https://access.redhat.com/errata/RHSA-2026:94584","https://access.redhat.com/errata/RHSA-2026:94631","https://access.redhat.com/errata/RHSA-2026:94702","https://access.redhat.com/errata/RHSA-2026:94709","https://access.redhat.com/errata/RHSA-2026:94715","https://access.redhat.com/errata/RHSA-2026:94717","https://access.redhat.com/errata/RHSA-2026:94721","https://access.redhat.com/errata/RHSA-2026:94738","https://access.redhat.com/errata/RHSA-2026:94802","https://access.redhat.com/errata/RHSA-2026:95058","https://access.redhat.com/errata/RHSA-2026:95090","https://access.redhat.com/errata/RHSA-2026:95264","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-114406","https://access.redhat.com/security/vulnerabilities/RHSB-2026-012","https://bugzilla.redhat.com/show_bug.cgi?id=2556046"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114406","description":"The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed."}]},{"artifact":{"id":"93eed475e569196b","cpes":["cpe:2.3:a:platform-python-pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python-pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"platform-python-pip","purl":"pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50181","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-50181","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50181","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50181","date":"2026-11-07","epss":0.00474,"percentile":0.41211}],"risk":0.24411000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-50181","description":"A flaw was found in urllib3. The `PoolManager` class allows redirects to be disabled by configuring retries in a specific manner, effectively bypassing intended HTTP redirection behavior. A network attacker can leverage this configuration to manipulate request flows and disrupt service. This bypass occurs through improper handling of retry parameters during PoolManager instantiation. This issue can reult in a denial of service or unintended data exposure due to altered request destinations."},"relatedVulnerabilities":[{"id":"CVE-2025-50181","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50181","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50181","date":"2026-11-07","epss":0.00474,"percentile":0.41211}],"urls":["https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857","https://github.com/urllib3/urllib3/releases/tag/2.5.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0."}]},{"artifact":{"id":"fa83cdeeda4e9e6a","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50181","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-50181","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50181","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50181","date":"2026-11-07","epss":0.00474,"percentile":0.41211}],"risk":0.24411000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-50181","description":"A flaw was found in urllib3. The `PoolManager` class allows redirects to be disabled by configuring retries in a specific manner, effectively bypassing intended HTTP redirection behavior. A network attacker can leverage this configuration to manipulate request flows and disrupt service. This bypass occurs through improper handling of retry parameters during PoolManager instantiation. This issue can reult in a denial of service or unintended data exposure due to altered request destinations."},"relatedVulnerabilities":[{"id":"CVE-2025-50181","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50181","cwe":"CWE-601","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-50181","date":"2026-11-07","epss":0.00474,"percentile":0.41211}],"urls":["https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857","https://github.com/urllib3/urllib3/releases/tag/2.5.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0."}]},{"artifact":{"id":"af4525477ddde7ef","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=rhel-8.10&upstream=krb5-1.18.2-34.el8_10.src.rpm","type":"rpm","version":"1.18.2-34.el8_10","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.18.2-34.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"krb5","version":"1.18.2-34.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-07","epss":0.00424,"percentile":0.36958}],"risk":0.24379999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107778","description":"A flaw was found in krb5. An authenticated remote attacker can cause a Denial of Service (DoS) by sending specially crafted forwarded credentials containing mismatched credential entries. This improper handling triggers a null pointer dereference, causing the service to crash and become unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-07","epss":0.00424,"percentile":0.36958}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"797a0e1b827791c1","cpes":["cpe:2.3:a:krb5-workstation:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5-workstation:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_workstation:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_workstation:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*"],"name":"krb5-workstation","purl":"pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=rhel-8.10&upstream=krb5-1.18.2-34.el8_10.src.rpm","type":"rpm","version":"1.18.2-34.el8_10","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.18.2-34.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"krb5","version":"1.18.2-34.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-07","epss":0.00424,"percentile":0.36958}],"risk":0.24379999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107778","description":"A flaw was found in krb5. An authenticated remote attacker can cause a Denial of Service (DoS) by sending specially crafted forwarded credentials containing mismatched credential entries. This improper handling triggers a null pointer dereference, causing the service to crash and become unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-07","epss":0.00424,"percentile":0.36958}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"4f954c6e0eab6dee","cpes":["cpe:2.3:a:libkadm5:libkadm5:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libkadm5:1.18.2-34.el8_10:*:*:*:*:*:*:*"],"name":"libkadm5","purl":"pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=rhel-8.10&upstream=krb5-1.18.2-34.el8_10.src.rpm","type":"rpm","version":"1.18.2-34.el8_10","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.18.2-34.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"krb5","version":"1.18.2-34.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-07","epss":0.00424,"percentile":0.36958}],"risk":0.24379999999999996,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107778","description":"A flaw was found in krb5. An authenticated remote attacker can cause a Denial of Service (DoS) by sending specially crafted forwarded credentials containing mismatched credential entries. This improper handling triggers a null pointer dereference, causing the service to crash and become unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-07","epss":0.00424,"percentile":0.36958}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-07","epss":0.00472,"percentile":0.41014}],"risk":0.24308000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19672","description":"A flaw was found in the Python `tarfile` module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX (Portable Operating System Interface) platforms. This occurs when processing a specially crafted archive containing member names that use directory traversal sequences (e.g., `../`) to leave and then re-enter the target directory. While only empty directories are created outside the destination, this can lead to unintended file system modifications."},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-07","epss":0.00472,"percentile":0.41014}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-07","epss":0.00472,"percentile":0.41014}],"risk":0.24308000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19672","description":"A flaw was found in the Python `tarfile` module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX (Portable Operating System Interface) platforms. This occurs when processing a specially crafted archive containing member names that use directory traversal sequences (e.g., `../`) to leave and then re-enter the target directory. While only empty directories are created outside the destination, this can lead to unintended file system modifications."},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-07","epss":0.00472,"percentile":0.41014}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7168","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-11-07","epss":0.00471,"percentile":0.40981}],"risk":0.242565,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7168","description":"A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user."},"relatedVulnerabilities":[{"id":"CVE-2026-7168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-11-07","epss":0.00471,"percentile":0.40981}],"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7168","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-11-07","epss":0.00471,"percentile":0.40981}],"risk":0.242565,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-7168","description":"A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user."},"relatedVulnerabilities":[{"id":"CVE-2026-7168","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-11-07","epss":0.00471,"percentile":0.40981}],"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-54872","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-54872","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-11-07","epss":0.00444,"percentile":0.38835}],"risk":0.24198000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-54872","description":"A flaw was found in OpenSSL. A timing side-channel vulnerability in generic elliptic curve scalar multiplication allows an attacker to recover private cryptographic keys. When performing signature operations, such as the Elliptic Curve Digital Signature Algorithm (ECDSA) or SM2, using curves without dedicated constant-time implementations, variations in processing time leak information about the per-signature secret value. By measuring the duration of numerous signing operations, an attacker can analyze these timing differences to reconstruct the private signing key."},"relatedVulnerabilities":[{"id":"CVE-2026-54872","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-11-07","epss":0.00444,"percentile":0.38835}],"urls":["https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179","https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb","https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd","https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54872","description":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54872","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-54872","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-11-07","epss":0.00444,"percentile":0.38835}],"risk":0.24198000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-54872","description":"A flaw was found in OpenSSL. A timing side-channel vulnerability in generic elliptic curve scalar multiplication allows an attacker to recover private cryptographic keys. When performing signature operations, such as the Elliptic Curve Digital Signature Algorithm (ECDSA) or SM2, using curves without dedicated constant-time implementations, variations in processing time leak information about the per-signature secret value. By measuring the duration of numerous signing operations, an attacker can analyze these timing differences to reconstruct the private signing key."},"relatedVulnerabilities":[{"id":"CVE-2026-54872","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-11-07","epss":0.00444,"percentile":0.38835}],"urls":["https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179","https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb","https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd","https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54872","description":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-07","epss":0.00721,"percentile":0.54184}],"risk":0.24153499999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92389","description":"A flaw was found in curl. When handling Trivial File Transfer Protocol (TFTP) transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive data from prior operations on a reused connection handle to the attacker's server."},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-07","epss":0.00721,"percentile":0.54184}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-07","epss":0.00721,"percentile":0.54184}],"risk":0.24153499999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92389","description":"A flaw was found in curl. When handling Trivial File Transfer Protocol (TFTP) transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive data from prior operations on a reused connection handle to the attacker's server."},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-07","epss":0.00721,"percentile":0.54184}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4360","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4360","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4360","cwe":"CWE-281","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-4360","date":"2026-11-07","epss":0.00481,"percentile":0.41706}],"risk":0.2405,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4360","description":"A flaw was found in the Python `Tarfile.extract()` function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the `filter` parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leading to unauthorized modifications or privilege issues on the system."},"relatedVulnerabilities":[{"id":"CVE-2026-4360","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4360","cwe":"CWE-281","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-4360","date":"2026-11-07","epss":0.00481,"percentile":0.41706}],"urls":["https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92","https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0","https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301","https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a","https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f","https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44","https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e","https://github.com/python/cpython/issues/151987","https://github.com/python/cpython/pull/151988","https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4360","description":"In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4360","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4360","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4360","cwe":"CWE-281","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-4360","date":"2026-11-07","epss":0.00481,"percentile":0.41706}],"risk":0.2405,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4360","description":"A flaw was found in the Python `Tarfile.extract()` function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the `filter` parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leading to unauthorized modifications or privilege issues on the system."},"relatedVulnerabilities":[{"id":"CVE-2026-4360","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4360","cwe":"CWE-281","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-4360","date":"2026-11-07","epss":0.00481,"percentile":0.41706}],"urls":["https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92","https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0","https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301","https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a","https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f","https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44","https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e","https://github.com/python/cpython/issues/151987","https://github.com/python/cpython/pull/151988","https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4360","description":"In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-11-07","epss":0.00414,"percentile":0.35903}],"risk":0.23804999999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5545","description":"A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-5545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-11-07","epss":0.00414,"percentile":0.35903}],"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5545","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-11-07","epss":0.00414,"percentile":0.35903}],"risk":0.23804999999999993,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5545","description":"A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-5545","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-11-07","epss":0.00414,"percentile":0.35903}],"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."}]},{"artifact":{"id":"55281a0c21c596b7","cpes":["cpe:2.3:a:redhat:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=rhel-8.10&epoch=2&upstream=tar-1.30-11.el8_10.src.rpm","type":"rpm","version":"2:1.30-11.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2:1.30-13.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5704","versionConstraint":"< 2:1.30-13.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"tar","version":"2:1.30-11.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-5704","fix":{"state":"fixed","versions":["2:1.30-13.el8_10"],"available":[{"date":"2026-09-23","kind":"first-observed","version":"2:1.30-13.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-11-07","epss":0.00473,"percentile":0.41131}],"risk":0.2365,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:70390","link":"https://access.redhat.com/errata/RHSA-2026:70390"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."},"relatedVulnerabilities":[{"id":"CVE-2026-5704","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-11-07","epss":0.00473,"percentile":0.41131}],"urls":["https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:66514","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-5704","https://bugzilla.redhat.com/show_bug.cgi?id=2455360","http://www.openwall.com/lists/oss-security/2026/04/11/10","http://www.openwall.com/lists/oss-security/2026/04/11/11","http://www.openwall.com/lists/oss-security/2026/04/12/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0672","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0672","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.8,"impactScore":3.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-11-07","epss":0.0048,"percentile":0.41662}],"risk":0.2352,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0672","description":"An injection flaw has been discovered in Python. When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters."},"relatedVulnerabilities":[{"id":"CVE-2026-0672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-11-07","epss":0.0048,"percentile":0.41662}],"urls":["https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172","https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440","https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d","https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca","https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70","https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85","https://github.com/python/cpython/issues/143919","https://github.com/python/cpython/pull/143920","https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0672","description":"When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0672","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0672","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.8,"impactScore":3.6,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-11-07","epss":0.0048,"percentile":0.41662}],"risk":0.2352,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0672","description":"An injection flaw has been discovered in Python. When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters."},"relatedVulnerabilities":[{"id":"CVE-2026-0672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0672","cwe":"CWE-93","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-0672","date":"2026-11-07","epss":0.0048,"percentile":0.41662}],"urls":["https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172","https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440","https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d","https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca","https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70","https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85","https://github.com/python/cpython/issues/143919","https://github.com/python/cpython/pull/143920","https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0672","description":"When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters."}]},{"artifact":{"id":"b62be623a0a6b6c8","cpes":["cpe:2.3:a:cyrus-sasl-lib:cyrus-sasl-lib:2.1.27-6.el8_5:*:*:*:*:*:*:*","cpe:2.3:a:cyrus-sasl-lib:cyrus_sasl_lib:2.1.27-6.el8_5:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl_lib:cyrus-sasl-lib:2.1.27-6.el8_5:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl_lib:cyrus_sasl_lib:2.1.27-6.el8_5:*:*:*:*:*:*:*","cpe:2.3:a:cyrus-sasl:cyrus-sasl-lib:2.1.27-6.el8_5:*:*:*:*:*:*:*","cpe:2.3:a:cyrus-sasl:cyrus_sasl_lib:2.1.27-6.el8_5:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl:cyrus-sasl-lib:2.1.27-6.el8_5:*:*:*:*:*:*:*","cpe:2.3:a:cyrus_sasl:cyrus_sasl_lib:2.1.27-6.el8_5:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cyrus-sasl-lib:2.1.27-6.el8_5:*:*:*:*:*:*:*","cpe:2.3:a:redhat:cyrus_sasl_lib:2.1.27-6.el8_5:*:*:*:*:*:*:*","cpe:2.3:a:cyrus:cyrus-sasl-lib:2.1.27-6.el8_5:*:*:*:*:*:*:*","cpe:2.3:a:cyrus:cyrus_sasl_lib:2.1.27-6.el8_5:*:*:*:*:*:*:*"],"name":"cyrus-sasl-lib","purl":"pkg:rpm/redhat/cyrus-sasl-lib@2.1.27-6.el8_5?arch=x86_64&distro=rhel-8.10&upstream=cyrus-sasl-2.1.27-6.el8_5.src.rpm","type":"rpm","version":"2.1.27-6.el8_5","language":"","licenses":["BSD with advertising"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cyrus-sasl","version":"2.1.27-6.el8_5"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"cyrus-sasl","version":"2.1.27-6.el8_5"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-07","epss":0.00376,"percentile":0.31782}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-07","epss":0.00376,"percentile":0.31782}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20","https://lists.debian.org/debian-lts-announce/2026/10/msg00064.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"9d4b5e84721dd1cf","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/java/kafka/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/lz4-java-1.11.1.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4v53-57pg-c464","versionConstraint":"<=1.11.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4v53-57pg-c464","fix":{"state":"fixed","versions":["1.11.2"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106452","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106452","date":"2026-11-07","epss":0.00454,"percentile":0.39615}],"risk":0.23381000000000002,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464","https://nvd.nist.gov/vuln/detail/CVE-2026-106452","https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4v53-57pg-c464","description":"yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header"},"relatedVulnerabilities":[{"id":"CVE-2026-106452","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106452","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106452","date":"2026-11-07","epss":0.00454,"percentile":0.39615}],"urls":["https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106452","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2."}]},{"artifact":{"id":"4e1a723b1c308bef","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4v53-57pg-c464","versionConstraint":"<=1.11.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4v53-57pg-c464","fix":{"state":"fixed","versions":["1.11.2"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106452","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106452","date":"2026-11-07","epss":0.00454,"percentile":0.39615}],"risk":0.23381000000000002,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464","https://nvd.nist.gov/vuln/detail/CVE-2026-106452","https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4v53-57pg-c464","description":"yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header"},"relatedVulnerabilities":[{"id":"CVE-2026-106452","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106452","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106452","date":"2026-11-07","epss":0.00454,"percentile":0.39615}],"urls":["https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106452","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2."}]},{"artifact":{"id":"9d4b5e84721dd1cf","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/java/kafka/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/lz4-java-1.11.1.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gm45-99xc-r7wv","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gm45-99xc-r7wv","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106450","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106450","date":"2026-11-07","epss":0.00454,"percentile":0.39615}],"risk":0.23381000000000002,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv","https://nvd.nist.gov/vuln/detail/CVE-2026-106450","https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gm45-99xc-r7wv","description":"yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs"},"relatedVulnerabilities":[{"id":"CVE-2026-106450","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106450","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106450","date":"2026-11-07","epss":0.00454,"percentile":0.39615}],"urls":["https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106450","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"4e1a723b1c308bef","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gm45-99xc-r7wv","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gm45-99xc-r7wv","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106450","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106450","date":"2026-11-07","epss":0.00454,"percentile":0.39615}],"risk":0.23381000000000002,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv","https://nvd.nist.gov/vuln/detail/CVE-2026-106450","https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gm45-99xc-r7wv","description":"yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs"},"relatedVulnerabilities":[{"id":"CVE-2026-106450","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106450","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106450","date":"2026-11-07","epss":0.00454,"percentile":0.39615}],"urls":["https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106450","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28387","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-07","epss":0.00697,"percentile":0.53304}],"risk":0.23349499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28387","description":"A flaw was found in OpenSSL. An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. This vulnerability could lead to data corruption, application crashes, or, in severe cases, arbitrary code execution. This issue is highly specific and uncommon, as it only affects clients using both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages and communicating with a server publishing a TLSA record set with both types of records."},"relatedVulnerabilities":[{"id":"CVE-2026-28387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-07","epss":0.00697,"percentile":0.53304}],"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28387","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-07","epss":0.00697,"percentile":0.53304}],"risk":0.23349499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-28387","description":"A flaw was found in OpenSSL. An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. This vulnerability could lead to data corruption, application crashes, or, in severe cases, arbitrary code execution. This issue is highly specific and uncommon, as it only affects clients using both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages and communicating with a server publishing a TLSA record set with both types of records."},"relatedVulnerabilities":[{"id":"CVE-2026-28387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-07","epss":0.00697,"percentile":0.53304}],"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}]},{"artifact":{"id":"9596d540aa4016c7","cpes":["cpe:2.3:a:redhat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-2.el8_10.2?arch=x86_64&distro=rhel-8.10&upstream=expat-2.5.0-2.el8_10.2.src.rpm","type":"rpm","version":"2.5.0-2.el8_10.2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-117610","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"expat","version":"0:2.5.0-2.el8_10.2"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-117610","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-07","epss":0.00425,"percentile":0.37061}],"risk":0.23162500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-117610","description":"A flaw was found in expat. A remote attacker who controls input stream chunking can trigger a NULL pointer dereference by forcing an empty initial parse on an external entity subparser. Successful exploitation causes the application to crash, resulting in a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-117610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-07","epss":0.00425,"percentile":0.37061}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510","https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d","https://github.com/libexpat/libexpat/pull/1444","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117610","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42765","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42765","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-11-07","epss":0.00508,"percentile":0.43647}],"risk":0.22606000000000007,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42765","description":"A flaw was found in OpenSSL. When an application is configured with specific non-default settings for certificate verification, including both Online Certificate Status Protocol (OCSP) response checking and partial chain verification, a NULL dereference can occur. This vulnerability can be triggered if the certificate chain lacks a self-signed trusted anchor, causing the application to crash. This leads to a Denial of Service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-42765","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-11-07","epss":0.00508,"percentile":0.43647}],"urls":["https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334","https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42765","description":"Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42765","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42765","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-11-07","epss":0.00508,"percentile":0.43647}],"risk":0.22606000000000007,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42765","description":"A flaw was found in OpenSSL. When an application is configured with specific non-default settings for certificate verification, including both Online Certificate Status Protocol (OCSP) response checking and partial chain verification, a NULL dereference can occur. This vulnerability can be triggered if the certificate chain lacks a self-signed trusted anchor, causing the application to crash. This leads to a Denial of Service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-42765","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42765","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42765","date":"2026-11-07","epss":0.00508,"percentile":0.43647}],"urls":["https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334","https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42765","description":"Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42770","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42770","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42770","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42770","date":"2026-11-07","epss":0.00503,"percentile":0.43277}],"risk":0.223835,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42770","description":"A flaw was found in OpenSSL. A malicious peer can exploit this vulnerability by presenting a specially crafted DHX (X9.42) peer key. Due to improper validation of the peer key's subgroup membership, an attacker can recover the victim's private key after a small number of key exchange attempts. This information disclosure can lead to unauthorized access or further compromise of affected systems."},"relatedVulnerabilities":[{"id":"CVE-2026-42770","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42770","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42770","date":"2026-11-07","epss":0.00503,"percentile":0.43277}],"urls":["https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02","https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb","https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c","https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2","https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42770","description":"Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42)\npeer key, the peer key is not properly checked for the subgroup membership.\n\nImpact summary: A malicious peer which presents an X9.42 key carrying the\nvictim's p and g parameters, a forged q = r (a small prime factor of the\ncofactor (p−1)/q_local), and a public value Y of order r can recover the\nvictim's private key after a small number of key exchange attempts.\n\nWhen EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the\nsubgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's\nown q parameter, not the local key's q. The peer's domain parameters are\nthen matched against the domain parameters of the private key, but the value\nof q is not compared.\n\nA malicious peer who presents an X9.42 key carrying the victim's p, g,\na forged q = r (a small prime factor of the cofactor), and a public\nvalue Y of order r passes all checks. The shared secret then takes only\nr distinct values, leaking priv mod r. Repeating for each small-prime\nfactor of the cofactor and combining via CRT recovers the full private\nkey (Lim–Lee / small-subgroup-confinement attack).\n\nThe realistic attack surface is narrow: principally CMP deployments with\nlong-lived RA/CA DHX keys and bespoke enterprise or government applications\nusing X9.42 DHX static keys with interactive protocols and therefore this\nissue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, 3.1.2 and 3.0 are affected by this\nissue."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42770","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42770","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42770","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42770","date":"2026-11-07","epss":0.00503,"percentile":0.43277}],"risk":0.223835,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42770","description":"A flaw was found in OpenSSL. A malicious peer can exploit this vulnerability by presenting a specially crafted DHX (X9.42) peer key. Due to improper validation of the peer key's subgroup membership, an attacker can recover the victim's private key after a small number of key exchange attempts. This information disclosure can lead to unauthorized access or further compromise of affected systems."},"relatedVulnerabilities":[{"id":"CVE-2026-42770","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42770","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42770","date":"2026-11-07","epss":0.00503,"percentile":0.43277}],"urls":["https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02","https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb","https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c","https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2","https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42770","description":"Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42)\npeer key, the peer key is not properly checked for the subgroup membership.\n\nImpact summary: A malicious peer which presents an X9.42 key carrying the\nvictim's p and g parameters, a forged q = r (a small prime factor of the\ncofactor (p−1)/q_local), and a public value Y of order r can recover the\nvictim's private key after a small number of key exchange attempts.\n\nWhen EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the\nsubgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's\nown q parameter, not the local key's q. The peer's domain parameters are\nthen matched against the domain parameters of the private key, but the value\nof q is not compared.\n\nA malicious peer who presents an X9.42 key carrying the victim's p, g,\na forged q = r (a small prime factor of the cofactor), and a public\nvalue Y of order r passes all checks. The shared secret then takes only\nr distinct values, leaking priv mod r. Repeating for each small-prime\nfactor of the cofactor and combining via CRT recovers the full private\nkey (Lim–Lee / small-subgroup-confinement attack).\n\nThe realistic attack surface is narrow: principally CMP deployments with\nlong-lived RA/CA DHX keys and bespoke enterprise or government applications\nusing X9.42 DHX static keys with interactive protocols and therefore this\nissue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, 3.1.2 and 3.0 are affected by this\nissue."}]},{"artifact":{"id":"98d9819af65839e0","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.1.136.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.1.136.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.1.136.Final","type":"java-archive","version":"4.1.136.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/usr/share/java/kafka/netty-handler-4.1.136.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"9114e02d69825eed3a901d762026261af15a56ea","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/netty-handler-4.1.136.Final.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/netty-handler-4.1.136.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.137.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fccg-mwvh-qqg4","versionConstraint":"<=4.1.136.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.1.136.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fccg-mwvh-qqg4","fix":{"state":"fixed","versions":["4.1.137.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.1.137.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-11-07","epss":0.00374,"percentile":0.3156}],"risk":0.22253,"urls":["https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","https://nvd.nist.gov/vuln/detail/CVE-2026-75596","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fccg-mwvh-qqg4","description":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-75596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-11-07","epss":0.00374,"percentile":0.3156}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"57c644d21035769a","cpes":["cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy:1.1.10.5:*:*:*:*:*:*:*"],"name":"snappy-java","purl":"pkg:maven/org.xerial.snappy/snappy-java@1.1.10.5","type":"java-archive","version":"1.1.10.5","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.xerial.snappy","virtualPath":"/usr/share/java/kafka/snappy-java-1.1.10.5.jar","manifestName":"","pomArtifactID":"snappy-java","archiveDigests":[{"value":"ac605269f3598506196e469f1fb0d7ed5c55059e","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/snappy-java-1.1.10.5.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/snappy-java-1.1.10.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.10.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwq9-9ffj-mvrv","versionConstraint":"<=1.1.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.xerial.snappy:snappy-java","version":"1.1.10.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gwq9-9ffj-mvrv","fix":{"state":"fixed","versions":["1.1.10.9"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"1.1.10.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93451","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93451","date":"2026-11-07","epss":0.00296,"percentile":0.22393}],"risk":0.22199999999999998,"urls":["https://github.com/xerial/snappy-java/security/advisories/GHSA-gwq9-9ffj-mvrv","https://nvd.nist.gov/vuln/detail/CVE-2026-93451","https://github.com/xerial/snappy-java/issues/729","https://github.com/xerial/snappy-java/pull/739","https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75","https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802","https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9","https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwq9-9ffj-mvrv","description":"snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods"},"relatedVulnerabilities":[{"id":"CVE-2026-93451","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93451","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93451","date":"2026-11-07","epss":0.00296,"percentile":0.22393}],"urls":["https://github.com/xerial/snappy-java","https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802","https://github.com/xerial/snappy-java/issues/729","https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93451","description":"snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory."}]},{"artifact":{"id":"1775c26714af39c8","cpes":["cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy:1.1.10.5:*:*:*:*:*:*:*"],"name":"snappy-java","purl":"pkg:maven/org.xerial.snappy/snappy-java@1.1.10.5","type":"java-archive","version":"1.1.10.5","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.xerial.snappy","virtualPath":"/usr/share/java/cp-base-new/snappy-java-1.1.10.5.jar","manifestName":"","pomArtifactID":"snappy-java","archiveDigests":[{"value":"ac605269f3598506196e469f1fb0d7ed5c55059e","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/snappy-java-1.1.10.5.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/snappy-java-1.1.10.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.10.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwq9-9ffj-mvrv","versionConstraint":"<=1.1.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.xerial.snappy:snappy-java","version":"1.1.10.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gwq9-9ffj-mvrv","fix":{"state":"fixed","versions":["1.1.10.9"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"1.1.10.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93451","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93451","date":"2026-11-07","epss":0.00296,"percentile":0.22393}],"risk":0.22199999999999998,"urls":["https://github.com/xerial/snappy-java/security/advisories/GHSA-gwq9-9ffj-mvrv","https://nvd.nist.gov/vuln/detail/CVE-2026-93451","https://github.com/xerial/snappy-java/issues/729","https://github.com/xerial/snappy-java/pull/739","https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75","https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802","https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9","https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwq9-9ffj-mvrv","description":"snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods"},"relatedVulnerabilities":[{"id":"CVE-2026-93451","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93451","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93451","date":"2026-11-07","epss":0.00296,"percentile":0.22393}],"urls":["https://github.com/xerial/snappy-java","https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802","https://github.com/xerial/snappy-java/issues/729","https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93451","description":"snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory."}]},{"artifact":{"id":"1775c26714af39c8","cpes":["cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy:1.1.10.5:*:*:*:*:*:*:*"],"name":"snappy-java","purl":"pkg:maven/org.xerial.snappy/snappy-java@1.1.10.5","type":"java-archive","version":"1.1.10.5","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.xerial.snappy","virtualPath":"/usr/share/java/cp-base-new/snappy-java-1.1.10.5.jar","manifestName":"","pomArtifactID":"snappy-java","archiveDigests":[{"value":"ac605269f3598506196e469f1fb0d7ed5c55059e","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/snappy-java-1.1.10.5.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/snappy-java-1.1.10.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.10.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xqrx-qh46-34m7","versionConstraint":"<=1.1.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.xerial.snappy:snappy-java","version":"1.1.10.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xqrx-qh46-34m7","fix":{"state":"fixed","versions":["1.1.10.9"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"1.1.10.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116590","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-116590","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116590","date":"2026-11-07","epss":0.00407,"percentile":0.35235}],"risk":0.22181499999999998,"urls":["https://github.com/xerial/snappy-java/security/advisories/GHSA-xqrx-qh46-34m7","https://nvd.nist.gov/vuln/detail/CVE-2026-116590","https://github.com/xerial/snappy-java/pull/741","https://github.com/xerial/snappy-java/commit/2d7ca71c087a98f1219fb2d51909f3891c3ce77b","https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xqrx-qh46-34m7","description":"snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite"},"relatedVulnerabilities":[{"id":"CVE-2026-116590","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116590","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-116590","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116590","date":"2026-11-07","epss":0.00407,"percentile":0.35235}],"urls":["https://github.com/xerial/snappy-java/commit/2d7ca71c087a98f1219fb2d51909f3891c3ce77b","https://github.com/xerial/snappy-java/pull/741","https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9","https://github.com/xerial/snappy-java/security/advisories/GHSA-xqrx-qh46-34m7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116590","description":"snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9."}]},{"artifact":{"id":"57c644d21035769a","cpes":["cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy.snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:SnappyBundleActivator:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:SnappyBundleActivator:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:org.xerial.snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy-java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy_java:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy-java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy_java:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial-org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial_org:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:snappy:snappy:1.1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:xerial:snappy:1.1.10.5:*:*:*:*:*:*:*"],"name":"snappy-java","purl":"pkg:maven/org.xerial.snappy/snappy-java@1.1.10.5","type":"java-archive","version":"1.1.10.5","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.xerial.snappy","virtualPath":"/usr/share/java/kafka/snappy-java-1.1.10.5.jar","manifestName":"","pomArtifactID":"snappy-java","archiveDigests":[{"value":"ac605269f3598506196e469f1fb0d7ed5c55059e","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/snappy-java-1.1.10.5.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/snappy-java-1.1.10.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.10.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xqrx-qh46-34m7","versionConstraint":"<=1.1.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.xerial.snappy:snappy-java","version":"1.1.10.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xqrx-qh46-34m7","fix":{"state":"fixed","versions":["1.1.10.9"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"1.1.10.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116590","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-116590","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116590","date":"2026-11-07","epss":0.00407,"percentile":0.35235}],"risk":0.22181499999999998,"urls":["https://github.com/xerial/snappy-java/security/advisories/GHSA-xqrx-qh46-34m7","https://nvd.nist.gov/vuln/detail/CVE-2026-116590","https://github.com/xerial/snappy-java/pull/741","https://github.com/xerial/snappy-java/commit/2d7ca71c087a98f1219fb2d51909f3891c3ce77b","https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xqrx-qh46-34m7","description":"snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite"},"relatedVulnerabilities":[{"id":"CVE-2026-116590","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116590","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-116590","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116590","date":"2026-11-07","epss":0.00407,"percentile":0.35235}],"urls":["https://github.com/xerial/snappy-java/commit/2d7ca71c087a98f1219fb2d51909f3891c3ce77b","https://github.com/xerial/snappy-java/pull/741","https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9","https://github.com/xerial/snappy-java/security/advisories/GHSA-xqrx-qh46-34m7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116590","description":"snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9."}]},{"artifact":{"id":"c22794ff3ec67fe8","cpes":["cpe:2.3:a:redhat:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.56.4-177.el8_10?arch=x86_64&distro=rhel-8.10&upstream=glib2-2.56.4-177.el8_10.src.rpm","type":"rpm","version":"2.56.4-177.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-3360","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glib2","version":"0:2.56.4-177.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-3360","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3360","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-3360","date":"2026-11-07","epss":0.00662,"percentile":0.51916}],"risk":0.22177,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-3360","description":"A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function."},"relatedVulnerabilities":[{"id":"CVE-2025-3360","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3360","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-3360","date":"2026-11-07","epss":0.00662,"percentile":0.51916}],"urls":["https://access.redhat.com/security/cve/CVE-2025-3360","https://bugzilla.redhat.com/show_bug.cgi?id=2357754","https://gitlab.gnome.org/GNOME/glib/-/issues/3647","https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://gitlab.gnome.org/GNOME/glib/-/work_items/3647"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-3360","description":"A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8291","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-8291","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-11-07","epss":0.00466,"percentile":0.40598}],"risk":0.21669,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-8291","description":"A zip file handling flaw has been discovered in the python standard library `zipfile` module. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations."},"relatedVulnerabilities":[{"id":"CVE-2025-8291","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-11-07","epss":0.00466,"percentile":0.40598}],"urls":["https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267","https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46","https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6","https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196","https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4","https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388","https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3","https://github.com/python/cpython/issues/139700","https://github.com/python/cpython/pull/139702","https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/","https://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6p","https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8291","description":"The 'zipfile' module would not check the validity of the ZIP64 End of\nCentral Directory (EOCD) Locator record offset value would not be used to\nlocate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be\nassumed to be the previous record in the ZIP archive. This could be abused\nto create ZIP archives that are handled differently by the 'zipfile' module\ncompared to other ZIP implementations.\n\n\nRemediation maintains this behavior, but checks that the offset specified\nin the ZIP64 EOCD Locator record matches the expected value."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8291","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-8291","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-11-07","epss":0.00466,"percentile":0.40598}],"risk":0.21669,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-8291","description":"A zip file handling flaw has been discovered in the python standard library `zipfile` module. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations."},"relatedVulnerabilities":[{"id":"CVE-2025-8291","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8291","cwe":"CWE-1285","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8291","date":"2026-11-07","epss":0.00466,"percentile":0.40598}],"urls":["https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267","https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46","https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6","https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196","https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4","https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388","https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3","https://github.com/python/cpython/issues/139700","https://github.com/python/cpython/pull/139702","https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/","https://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6p","https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8291","description":"The 'zipfile' module would not check the validity of the ZIP64 End of\nCentral Directory (EOCD) Locator record offset value would not be used to\nlocate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be\nassumed to be the previous record in the ZIP archive. This could be abused\nto create ZIP archives that are handled differently by the 'zipfile' module\ncompared to other ZIP implementations.\n\n\nRemediation maintains this behavior, but checks that the offset specified\nin the ZIP64 EOCD Locator record matches the expected value."}]},{"artifact":{"id":"71c4e7274edbf7e5","cpes":["cpe:2.3:a:libtirpc:libtirpc:1.1.4-12.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libtirpc:1.1.4-12.el8_10:*:*:*:*:*:*:*"],"name":"libtirpc","purl":"pkg:rpm/redhat/libtirpc@1.1.4-12.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libtirpc-1.1.4-12.el8_10.src.rpm","type":"rpm","version":"1.1.4-12.el8_10","language":"","licenses":["SISSL and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85977","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libtirpc","version":"0:1.1.4-12.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-85977","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-07","epss":0.0042,"percentile":0.36591}],"risk":0.2163,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-85977","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-07","epss":0.0042,"percentile":0.36591}],"urls":["https://access.redhat.com/errata/RHSA-2026:80360","https://access.redhat.com/security/cve/CVE-2026-85977","https://bugzilla.redhat.com/show_bug.cgi?id=2478979"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-77696","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-77696","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-11-07","epss":0.00396,"percentile":0.34076}],"risk":0.21582000000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77696","description":"A flaw was found in OpenSSL. During SM2 signature generation, variable-time arithmetic operations are performed on secret values, creating an observable timing side-channel. An attacker capable of measuring signature generation times can collect timing data across multiple signing operations, which may allow them to recover the private key."},"relatedVulnerabilities":[{"id":"CVE-2026-77696","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-11-07","epss":0.00396,"percentile":0.34076}],"urls":["https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","description":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77696","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-77696","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-11-07","epss":0.00396,"percentile":0.34076}],"risk":0.21582000000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77696","description":"A flaw was found in OpenSSL. During SM2 signature generation, variable-time arithmetic operations are performed on secret values, creating an observable timing side-channel. An attacker capable of measuring signature generation times can collect timing data across multiple signing operations, which may allow them to recover the private key."},"relatedVulnerabilities":[{"id":"CVE-2026-77696","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-11-07","epss":0.00396,"percentile":0.34076}],"urls":["https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","description":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm."}]},{"artifact":{"id":"13b38de60a9fc1f5","cpes":["cpe:2.3:a:redhat:wget:1.19.5-16.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:wget:wget:1.19.5-16.el8_10:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:rpm/redhat/wget@1.19.5-16.el8_10?arch=x86_64&distro=rhel-8.10&upstream=wget-1.19.5-16.el8_10.src.rpm","type":"rpm","version":"1.19.5-16.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-16599","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"wget","version":"0:1.19.5-16.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-16599","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16599","cwe":"CWE-606","type":"Primary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16599","date":"2026-11-07","epss":0.00375,"percentile":0.31652}],"risk":0.21562499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-16599","description":"A flaw was found in wget's FTP OPIE/S-KEY authentication functionality. A malicious FTP server or a network attacker can send a specially crafted OPIE challenge. This challenge contains a sequence number that, when processed by wget, can lead to an excessive number of cryptographic computations. This prolonged computation can cause wget to become unresponsive, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-16599","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16599","cwe":"CWE-606","type":"Primary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16599","date":"2026-11-07","epss":0.00375,"percentile":0.31652}],"urls":["https://cert.pl/en/posts/2026/08/CVE-2026-16599","https://gitlab.com/gnuwget/wget","https://gitlab.com/gnuwget/wget/-/commit/e9697d98e7249b0f68a6be040a4f3dcc5bc101fa"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16599","description":"GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.\n\n\nThis issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa"}]},{"artifact":{"id":"9f1348c074e62048","cpes":["cpe:2.3:a:libgcc:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-07","epss":0.00395,"percentile":0.3392}],"risk":0.21527500000000005,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-07","epss":0.00395,"percentile":0.3392}],"urls":["https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"18d5838298e1194f","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-07","epss":0.00395,"percentile":0.3392}],"risk":0.21527500000000005,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-07","epss":0.00395,"percentile":0.3392}],"urls":["https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"c858d6e98e8cab23","cpes":["cpe:2.3:a:file-libs:file-libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:file-libs:file_libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:file_libs:file-libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:file_libs:file_libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:file-libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:file_libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:file:file-libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:file:file_libs:5.33-27.el8_10:*:*:*:*:*:*:*"],"name":"file-libs","purl":"pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=rhel-8.10&upstream=file-5.33-27.el8_10.src.rpm","type":"rpm","version":"5.33-27.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"file","version":"5.33-27.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-8905","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"file","version":"5.33-27.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-8905","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8905","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8905","date":"2026-11-07","epss":0.00457,"percentile":0.39876}],"risk":0.21479000000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-8905","description":"A vulnerability was found in the \"File\" project where a stack-based buffer over-read exists in the do_core_note function within readelf.c of libmagic.a, by using a specially crafted file the attacker could  access sensitive information or cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2019-8905","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":3.6,"impactScore":5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8905","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8905","date":"2026-11-07","epss":0.00457,"percentile":0.39876}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html","http://www.securityfocus.com/bid/107137","https://bugs.astron.com/view.php?id=63","https://lists.debian.org/debian-lts-announce/2019/02/msg00044.html","https://usn.ubuntu.com/3911-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-8905","description":"do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360."}]},{"artifact":{"id":"9596d540aa4016c7","cpes":["cpe:2.3:a:redhat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-2.el8_10.2?arch=x86_64&distro=rhel-8.10&upstream=expat-2.5.0-2.el8_10.2.src.rpm","type":"rpm","version":"2.5.0-2.el8_10.2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-118370","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"expat","version":"0:2.5.0-2.el8_10.2"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-118370","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-07","epss":0.00391,"percentile":0.33478}],"risk":0.21309500000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-118370","description":"A flaw was found in expat. An integer overflow in the XML attribute parsing logic allows a remote attacker to cause memory corruption and a Denial of Service (DoS). By supplying a specially crafted XML document containing an excessively large number of attributes, an attacker can trigger out-of-bounds memory writes, leading to an application crash."},"relatedVulnerabilities":[{"id":"CVE-2026-118370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-07","epss":0.00391,"percentile":0.33478}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","https://github.com/libexpat/libexpat/pull/1450","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118370","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."}]},{"artifact":{"id":"bcecf49dfefd132c","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.26.0-21.el8_10?arch=x86_64&distro=rhel-8.10&upstream=sqlite-3.26.0-21.el8_10.src.rpm","type":"rpm","version":"3.26.0-21.el8_10","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.26.0-21.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119379","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"sqlite","version":"3.26.0-21.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-119379","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-07","epss":0.00278,"percentile":0.20381}],"risk":0.21267,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119379","description":"A flaw was found in SQLite's session extension. A local attacker can supply a specially crafted changeset containing inconsistent table definitions, causing the application to write data past allocated memory boundaries. This heap-based buffer overflow results in memory corruption, potentially leading to arbitrary code execution or a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-119379","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-07","epss":0.00278,"percentile":0.20381}],"urls":["https://abraxaslabs.tech/research/sqlite-session-ncol","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/3f57024aecea0f3b","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119379","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."}]},{"artifact":{"id":"5c842fe0f64f5a4c","cpes":["cpe:2.3:a:libssh:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh","purl":"pkg:rpm/redhat/libssh@0.9.6-17.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0964","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0:0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0964","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0964","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0964","date":"2026-11-07","epss":0.00424,"percentile":0.36958}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0964","description":"A malicious SCP server can send unexpected paths that could make the\nclient application override local files outside of working directory.\nThis could be misused to create malicious executable or configuration\nfiles and make the user execute them under specific consequences.\nThis is the same issue as in OpenSSH, tracked as CVE-2019-6111."},"relatedVulnerabilities":[{"id":"CVE-2026-0964","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0964","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0964","date":"2026-11-07","epss":0.00424,"percentile":0.36958}],"urls":["https://access.redhat.com/errata/RHSA-2026:18160","https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2026-0964","https://bugzilla.redhat.com/show_bug.cgi?id=2436979","https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0964","description":"A malicious SCP server can send unexpected paths that could make the\nclient application override local files outside of working directory.\nThis could be misused to create malicious executable or configuration\nfiles and make the user execute them under specific consequences.\n\nThis is the same issue as in OpenSSH, tracked as CVE-2019-6111."}]},{"artifact":{"id":"bd8c4541a903d30b","cpes":["cpe:2.3:a:libssh-config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh-config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh-config","purl":"pkg:rpm/redhat/libssh-config@0.9.6-17.el8_10?arch=noarch&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libssh","version":"0.9.6-17.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0964","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0964","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0964","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0964","date":"2026-11-07","epss":0.00424,"percentile":0.36958}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0964","description":"A malicious SCP server can send unexpected paths that could make the\nclient application override local files outside of working directory.\nThis could be misused to create malicious executable or configuration\nfiles and make the user execute them under specific consequences.\nThis is the same issue as in OpenSSH, tracked as CVE-2019-6111."},"relatedVulnerabilities":[{"id":"CVE-2026-0964","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0964","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0964","date":"2026-11-07","epss":0.00424,"percentile":0.36958}],"urls":["https://access.redhat.com/errata/RHSA-2026:18160","https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2026-0964","https://bugzilla.redhat.com/show_bug.cgi?id=2436979","https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0964","description":"A malicious SCP server can send unexpected paths that could make the\nclient application override local files outside of working directory.\nThis could be misused to create malicious executable or configuration\nfiles and make the user execute them under specific consequences.\n\nThis is the same issue as in OpenSSH, tracked as CVE-2019-6111."}]},{"artifact":{"id":"9f1348c074e62048","cpes":["cpe:2.3:a:libgcc:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libgcc:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libgcc","purl":"pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.5.0-30.el8_10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"< 0:8.5.0-30.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"fixed","versions":["0:8.5.0-30.el8_10"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"0:8.5.0-30.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-07","epss":0.00348,"percentile":0.2862}],"risk":0.2088,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:89830","link":"https://access.redhat.com/errata/RHSA-2026:89830"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-07","epss":0.00348,"percentile":0.2862}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"18d5838298e1194f","cpes":["cpe:2.3:a:libstdc\\+\\+:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libstdc\\+\\+:8.5.0-28.el8_10:*:*:*:*:*:*:*"],"name":"libstdc++","purl":"pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gcc-8.5.0-28.el8_10.src.rpm","type":"rpm","version":"8.5.0-28.el8_10","language":"","licenses":["GPLv3+ and GPLv3+ with exceptions and GPLv2+ with exceptions and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"gcc","version":"8.5.0-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.5.0-30.el8_10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"< 0:8.5.0-30.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gcc","version":"8.5.0-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"fixed","versions":["0:8.5.0-30.el8_10"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"0:8.5.0-30.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-07","epss":0.00348,"percentile":0.2862}],"risk":0.2088,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:89830","link":"https://access.redhat.com/errata/RHSA-2026:89830"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-07","epss":0.00348,"percentile":0.2862}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"0bc0698cf4cd83dd","cpes":["cpe:2.3:a:iputils:iputils:20180629-11.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:iputils:20180629-11.el8:*:*:*:*:*:*:*"],"name":"iputils","purl":"pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=rhel-8.10&upstream=iputils-20180629-11.el8.src.rpm","type":"rpm","version":"20180629-11.el8","language":"","licenses":["BSD and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-48964","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"iputils","version":"0:20180629-11.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-48964","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48964","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-48964","date":"2026-11-07","epss":0.00404,"percentile":0.34872}],"risk":0.20806000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-48964","description":"An integer overflow flaw has been discovered in the ping function within the iputils package. This overflow may allow an attacker to craft an ECHO reply which can prevent iputils from operating normally."},"relatedVulnerabilities":[{"id":"CVE-2025-48964","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48964","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-48964","date":"2026-11-07","epss":0.00404,"percentile":0.34872}],"urls":["https://bugzilla.suse.com/show_bug.cgi?id=1243772","https://github.com/iputils/iputils/commit/afa36390394a6e0cceba03b52b59b6d41710608c","https://github.com/iputils/iputils/issues","https://github.com/iputils/iputils/releases/tag/20250602","https://github.com/iputils/iputils/security/advisories/GHSA-25fr-jw29-74f9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48964","description":"ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero)."}]},{"artifact":{"id":"3fa5e9a1b5f18fed","cpes":["cpe:2.3:a:redhat:pcre2:10.32-3.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.32-3.el8_6:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=rhel-8.10&upstream=pcre2-10.32-3.el8_6.src.rpm","type":"rpm","version":"10.32-3.el8_6","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.32-4.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"< 0:10.32-4.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"pcre2","version":"0:10.32-3.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"fixed","versions":["0:10.32-4.el8_10"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.32-4.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-11-07","epss":0.00269,"percentile":0.19116}],"risk":0.20309500000000003,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:81613","link":"https://access.redhat.com/errata/RHSA-2026:81613"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103111","description":"A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-11-07","epss":0.00269,"percentile":0.19116}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"9596d540aa4016c7","cpes":["cpe:2.3:a:redhat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-2.el8_10.2?arch=x86_64&distro=rhel-8.10&upstream=expat-2.5.0-2.el8_10.2.src.rpm","type":"rpm","version":"2.5.0-2.el8_10.2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.5.0-6.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"< 0:2.5.0-6.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"expat","version":"0:2.5.0-2.el8_10.2"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"fixed","versions":["0:2.5.0-6.el8_10"],"available":[{"date":"2026-10-31","kind":"first-observed","version":"0:2.5.0-6.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-11-07","epss":0.00368,"percentile":0.30825}],"risk":0.20056000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:92323","link":"https://access.redhat.com/errata/RHSA-2026:92323"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-102633","description":"A flaw was found in expat. On 32-bit systems, an integer overflow occurs within the expat_realloc memory allocation function when calculating buffer sizes. A remote attacker can exploit this vulnerability by supplying specially crafted XML input to an application that processes data with the library. Successful exploitation can lead to a Denial of Service (DoS) or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-11-07","epss":0.00368,"percentile":0.30825}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"7099e1b9cc673e8a","cpes":["cpe:2.3:a:redhat:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4437","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"0:2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4437","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4437","cwe":"CWE-125","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-4437","date":"2026-11-07","epss":0.00345,"percentile":0.28223}],"risk":0.198375,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4437","description":"A flaw was found in glibc (the GNU C Library). When an application uses the `gethostbyaddr` or `gethostbyaddr_r` functions with a `nsswitch.conf` configuration that specifies glibc's DNS backend, a remote attacker can send a specially crafted DNS (Domain Name System) response. This crafted response can cause the application to incorrectly interpret a non-answer section of the DNS response as a valid answer, leading to potential misbehavior or incorrect information processing."},"relatedVulnerabilities":[{"id":"CVE-2026-4437","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4437","cwe":"CWE-125","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-4437","date":"2026-11-07","epss":0.00345,"percentile":0.28223}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34014","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4437","description":"Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer."}]},{"artifact":{"id":"f9f2f96854016567","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4437","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4437","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4437","cwe":"CWE-125","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-4437","date":"2026-11-07","epss":0.00345,"percentile":0.28223}],"risk":0.198375,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4437","description":"A flaw was found in glibc (the GNU C Library). When an application uses the `gethostbyaddr` or `gethostbyaddr_r` functions with a `nsswitch.conf` configuration that specifies glibc's DNS backend, a remote attacker can send a specially crafted DNS (Domain Name System) response. This crafted response can cause the application to incorrectly interpret a non-answer section of the DNS response as a valid answer, leading to potential misbehavior or incorrect information processing."},"relatedVulnerabilities":[{"id":"CVE-2026-4437","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4437","cwe":"CWE-125","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-4437","date":"2026-11-07","epss":0.00345,"percentile":0.28223}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34014","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4437","description":"Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer."}]},{"artifact":{"id":"44a10f7911e45aa5","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4437","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4437","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4437","cwe":"CWE-125","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-4437","date":"2026-11-07","epss":0.00345,"percentile":0.28223}],"risk":0.198375,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4437","description":"A flaw was found in glibc (the GNU C Library). When an application uses the `gethostbyaddr` or `gethostbyaddr_r` functions with a `nsswitch.conf` configuration that specifies glibc's DNS backend, a remote attacker can send a specially crafted DNS (Domain Name System) response. This crafted response can cause the application to incorrectly interpret a non-answer section of the DNS response as a valid answer, leading to potential misbehavior or incorrect information processing."},"relatedVulnerabilities":[{"id":"CVE-2026-4437","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4437","cwe":"CWE-125","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-4437","date":"2026-11-07","epss":0.00345,"percentile":0.28223}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34014","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4437","description":"Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-07","epss":0.00584,"percentile":0.4816}],"risk":0.19563999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18924","description":"A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-07","epss":0.00584,"percentile":0.4816}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18924","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-07","epss":0.00584,"percentile":0.4816}],"risk":0.19563999999999995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18924","description":"A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-18924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-11-07","epss":0.00584,"percentile":0.4816}],"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."}]},{"artifact":{"id":"7099e1b9cc673e8a","cpes":["cpe:2.3:a:redhat:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.28-251.el8_10.48"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"< 0:2.28-251.el8_10.48 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"0:2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"fixed","versions":["0:2.28-251.el8_10.48"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:2.28-251.el8_10.48"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:80798","link":"https://access.redhat.com/errata/RHSA-2026:80798"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77117","description":"A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"7099e1b9cc673e8a","cpes":["cpe:2.3:a:redhat:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.28-251.el8_10.48"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"< 0:2.28-251.el8_10.48 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"0:2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"fixed","versions":["0:2.28-251.el8_10.48"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:2.28-251.el8_10.48"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:80798","link":"https://access.redhat.com/errata/RHSA-2026:80798"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80489","description":"A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"f9f2f96854016567","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.28-251.el8_10.48"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"< 0:2.28-251.el8_10.48 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"fixed","versions":["0:2.28-251.el8_10.48"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:2.28-251.el8_10.48"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:80798","link":"https://access.redhat.com/errata/RHSA-2026:80798"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77117","description":"A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"f9f2f96854016567","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.28-251.el8_10.48"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"< 0:2.28-251.el8_10.48 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"fixed","versions":["0:2.28-251.el8_10.48"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:2.28-251.el8_10.48"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:80798","link":"https://access.redhat.com/errata/RHSA-2026:80798"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80489","description":"A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"44a10f7911e45aa5","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.28-251.el8_10.48"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"< 0:2.28-251.el8_10.48 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"fixed","versions":["0:2.28-251.el8_10.48"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:2.28-251.el8_10.48"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:80798","link":"https://access.redhat.com/errata/RHSA-2026:80798"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-77117","description":"A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"44a10f7911e45aa5","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.28-251.el8_10.48"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"< 0:2.28-251.el8_10.48 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"fixed","versions":["0:2.28-251.el8_10.48"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:2.28-251.el8_10.48"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:80798","link":"https://access.redhat.com/errata/RHSA-2026:80798"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80489","description":"A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-11-07","epss":0.00358,"percentile":0.29777}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:3.6.8-79.el8_10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"< 0:3.6.8-79.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"fixed","versions":["0:3.6.8-79.el8_10"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:3.6.8-79.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-07","epss":0.00344,"percentile":0.28096}],"risk":0.19435999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:85239","link":"https://access.redhat.com/errata/RHSA-2026:85239"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-12345","description":"A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link (a reference pointing to another location). This can lead to unauthorized deletion or alteration of files outside the temporary directory, performed with the privileges of the process executing the cleanup."},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-07","epss":0.00344,"percentile":0.28096}],"urls":["https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:3.6.8-79.el8_10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"< 0:3.6.8-79.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"fixed","versions":["0:3.6.8-79.el8_10"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"0:3.6.8-79.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-07","epss":0.00344,"percentile":0.28096}],"risk":0.19435999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:85239","link":"https://access.redhat.com/errata/RHSA-2026:85239"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-12345","description":"A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link (a reference pointing to another location). This can lead to unauthorized deletion or alteration of files outside the temporary directory, performed with the privileges of the process executing the cleanup."},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-07","epss":0.00344,"percentile":0.28096}],"urls":["https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"14f406c5bcf8faf4","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.7?arch=x86_64&distro=rhel-8.10&upstream=libxml2-2.9.7-21.el8_10.7.src.rpm","type":"rpm","version":"2.9.7-21.el8_10.7","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.9.7-21.el8_10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6653","versionConstraint":"< 0:2.9.7-21.el8_10.8 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libxml2","version":"0:2.9.7-21.el8_10.7"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-6653","fix":{"state":"fixed","versions":["0:2.9.7-21.el8_10.8"],"available":[{"date":"2026-09-22","kind":"first-observed","version":"0:2.9.7-21.el8_10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6653","cwe":"CWE-416","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-6653","cwe":"CWE-611","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-6653","date":"2026-11-07","epss":0.00355,"percentile":0.29441}],"risk":0.19347500000000004,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:69655","link":"https://access.redhat.com/errata/RHSA-2026:69655"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6653","description":"A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the `xmlParseInternalSubset` function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service (DoS), making the affected system or application unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-6653","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6653","cwe":"CWE-416","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-6653","cwe":"CWE-611","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-6653","date":"2026-11-07","epss":0.00355,"percentile":0.29441}],"urls":["https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260","https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6653","description":"Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling."}]},{"artifact":{"id":"9d4b5e84721dd1cf","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/java/kafka/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/lz4-java-1.11.1.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cx8-rjf8-pr8g","versionConstraint":"<=1.11.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cx8-rjf8-pr8g","fix":{"state":"fixed","versions":["1.11.2"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106453","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106453","date":"2026-11-07","epss":0.00372,"percentile":0.313}],"risk":0.19158,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g","https://nvd.nist.gov/vuln/detail/CVE-2026-106453","https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cx8-rjf8-pr8g","description":"yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError"},"relatedVulnerabilities":[{"id":"CVE-2026-106453","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106453","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106453","date":"2026-11-07","epss":0.00372,"percentile":0.313}],"urls":["https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106453","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2."}]},{"artifact":{"id":"4e1a723b1c308bef","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cx8-rjf8-pr8g","versionConstraint":"<=1.11.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cx8-rjf8-pr8g","fix":{"state":"fixed","versions":["1.11.2"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.11.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106453","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106453","date":"2026-11-07","epss":0.00372,"percentile":0.313}],"risk":0.19158,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g","https://nvd.nist.gov/vuln/detail/CVE-2026-106453","https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cx8-rjf8-pr8g","description":"yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError"},"relatedVulnerabilities":[{"id":"CVE-2026-106453","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106453","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106453","date":"2026-11-07","epss":0.00372,"percentile":0.313}],"urls":["https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106453","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1795","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-1795","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1795","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1795","date":"2026-11-07","epss":0.00628,"percentile":0.50342}],"risk":0.19154000000000002,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1795","description":"A flaw was found in Python. When a separating comma ends up on a folded line during an address list folding of email headers, the comma is unintentionally unicode encoded. The expected behavior is that the separating comma remains unencoded. This can result in the address header being misinterpreted by some mail servers."},"relatedVulnerabilities":[{"id":"CVE-2025-1795","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1795","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1795","date":"2026-11-07","epss":0.00628,"percentile":0.50342}],"urls":["https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48","https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593","https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74","https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d","https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090","https://github.com/python/cpython/issues/100884","https://github.com/python/cpython/pull/100885","https://github.com/python/cpython/pull/119099","https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1795","description":"During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1795","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-1795","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1795","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1795","date":"2026-11-07","epss":0.00628,"percentile":0.50342}],"risk":0.19154000000000002,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1795","description":"A flaw was found in Python. When a separating comma ends up on a folded line during an address list folding of email headers, the comma is unintentionally unicode encoded. The expected behavior is that the separating comma remains unencoded. This can result in the address header being misinterpreted by some mail servers."},"relatedVulnerabilities":[{"id":"CVE-2025-1795","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1795","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1795","date":"2026-11-07","epss":0.00628,"percentile":0.50342}],"urls":["https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48","https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593","https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74","https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d","https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090","https://github.com/python/cpython/issues/100884","https://github.com/python/cpython/pull/100885","https://github.com/python/cpython/pull/119099","https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1795","description":"During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers."}]},{"artifact":{"id":"c22794ff3ec67fe8","cpes":["cpe:2.3:a:redhat:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.56.4-177.el8_10?arch=x86_64&distro=rhel-8.10&upstream=glib2-2.56.4-177.el8_10.src.rpm","type":"rpm","version":"2.56.4-177.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1489","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glib2","version":"0:2.56.4-177.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-1489","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1489","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1489","date":"2026-11-07","epss":0.00366,"percentile":0.30644}],"risk":0.19032000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1489","description":"A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable."},"relatedVulnerabilities":[{"id":"CVE-2026-1489","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1489","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1489","date":"2026-11-07","epss":0.00366,"percentile":0.30644}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1489","https://bugzilla.redhat.com/show_bug.cgi?id=2433348","https://gitlab.gnome.org/GNOME/glib/-/issues/3872","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1489","description":"A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable."}]},{"artifact":{"id":"b136a6b20e37bb61","cpes":["cpe:2.3:a:redhat:gawk:4.2.1-4.el8:*:*:*:*:*:*:*","cpe:2.3:a:gawk:gawk:4.2.1-4.el8:*:*:*:*:*:*:*"],"name":"gawk","purl":"pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=rhel-8.10&upstream=gawk-4.2.1-4.el8.src.rpm","type":"rpm","version":"4.2.1-4.el8","language":"","licenses":["GPLv3+ and GPLv2+ and LGPLv2+ and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-4156","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gawk","version":"0:4.2.1-4.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-4156","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4156","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-4156","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4156","date":"2026-11-07","epss":0.00415,"percentile":0.36087}],"risk":0.188825,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-4156","description":"A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2023-4156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4156","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-4156","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4156","date":"2026-11-07","epss":0.00415,"percentile":0.36087}],"urls":["https://access.redhat.com/security/cve/CVE-2023-4156","https://bugzilla.redhat.com/show_bug.cgi?id=2215930"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4156","description":"A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information."}]},{"artifact":{"id":"c22794ff3ec67fe8","cpes":["cpe:2.3:a:redhat:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.56.4-177.el8_10?arch=x86_64&distro=rhel-8.10&upstream=glib2-2.56.4-177.el8_10.src.rpm","type":"rpm","version":"2.56.4-177.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-32665","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glib2","version":"0:2.56.4-177.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-32665","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32665","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-32665","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-32665","date":"2026-11-07","epss":0.00392,"percentile":0.33596}],"risk":0.1862,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-32665","description":"A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-32665","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32665","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-32665","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-32665","date":"2026-11-07","epss":0.00392,"percentile":0.33596}],"urls":["https://access.redhat.com/security/cve/CVE-2023-32665","https://bugzilla.redhat.com/show_bug.cgi?id=2211827","https://gitlab.gnome.org/GNOME/glib/-/issues/2121","https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html","https://security.gentoo.org/glsa/202311-18","https://security.netapp.com/advisory/ntap-20240426-0006/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32665","description":"A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service."}]},{"artifact":{"id":"3fa5e9a1b5f18fed","cpes":["cpe:2.3:a:redhat:pcre2:10.32-3.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.32-3.el8_6:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=rhel-8.10&upstream=pcre2-10.32-3.el8_6.src.rpm","type":"rpm","version":"10.32-3.el8_6","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.32-4.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"< 0:10.32-4.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"pcre2","version":"0:10.32-3.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"fixed","versions":["0:10.32-4.el8_10"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.32-4.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-11-07","epss":0.00348,"percentile":0.28611}],"risk":0.18618,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:81613","link":"https://access.redhat.com/errata/RHSA-2026:81613"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89157","description":"A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2_pattern_convert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability impact, causing a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-11-07","epss":0.00348,"percentile":0.28611}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103995","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-103995","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-07","epss":0.0036,"percentile":0.29949}],"risk":0.1854,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103995","description":"A flaw was found in Python. Its Hypertext Transfer Protocol (HTTP) response and chunk parsing logic incorrectly processes non-hexadecimal or negative integers. A remote server can exploit this by returning a specially crafted HTTP response to a client application. This flaw can cause the application to misinterpret the response content, leading to data integrity issues."},"relatedVulnerabilities":[{"id":"CVE-2026-103995","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-07","epss":0.0036,"percentile":0.29949}],"urls":["https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae","https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d","https://github.com/python/cpython/issues/150751","https://github.com/python/cpython/pull/150752"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103995","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-103995","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-07","epss":0.0036,"percentile":0.29949}],"risk":0.1854,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-103995","description":"A flaw was found in Python. Its Hypertext Transfer Protocol (HTTP) response and chunk parsing logic incorrectly processes non-hexadecimal or negative integers. A remote server can exploit this by returning a specially crafted HTTP response to a client application. This flaw can cause the application to misinterpret the response content, leading to data integrity issues."},"relatedVulnerabilities":[{"id":"CVE-2026-103995","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-07","epss":0.0036,"percentile":0.29949}],"urls":["https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae","https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d","https://github.com/python/cpython/issues/150751","https://github.com/python/cpython/pull/150752"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents."}]},{"artifact":{"id":"55281a0c21c596b7","cpes":["cpe:2.3:a:redhat:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:2\\:1.30-11.el8_10:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=rhel-8.10&epoch=2&upstream=tar-1.30-11.el8_10.src.rpm","type":"rpm","version":"2:1.30-11.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-33056","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"tar","version":"2:1.30-11.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-33056","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33056","cwe":"CWE-61","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33056","date":"2026-11-07","epss":0.00394,"percentile":0.33855}],"risk":0.18518,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-33056","description":"A flaw was found in tar-rs, a Rust library for reading and writing tar archives. When unpacking a crafted tar archive, an attacker can exploit a symbolic link vulnerability. By including a symlink followed by a directory with the same name, the library incorrectly applies file permissions to the symlink's target. This allows an attacker to modify the permissions of arbitrary directories outside the intended extraction location."},"relatedVulnerabilities":[{"id":"CVE-2026-33056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33056","cwe":"CWE-61","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33056","date":"2026-11-07","epss":0.00394,"percentile":0.33855}],"urls":["https://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446","https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33056","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-15224","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-15224","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-11-07","epss":0.0048,"percentile":0.41652}],"risk":0.1848,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15224","description":"A flaw was found in libcurl. When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."},"relatedVulnerabilities":[{"id":"CVE-2025-15224","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-11-07","epss":0.0048,"percentile":0.41652}],"urls":["https://curl.se/docs/CVE-2025-15224.html","https://curl.se/docs/CVE-2025-15224.json","https://hackerone.com/reports/3480925","http://www.openwall.com/lists/oss-security/2026/01/07/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","description":"When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15224","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-15224","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-11-07","epss":0.0048,"percentile":0.41652}],"risk":0.1848,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-15224","description":"A flaw was found in libcurl. When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."},"relatedVulnerabilities":[{"id":"CVE-2025-15224","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-11-07","epss":0.0048,"percentile":0.41652}],"urls":["https://curl.se/docs/CVE-2025-15224.html","https://curl.se/docs/CVE-2025-15224.json","https://hackerone.com/reports/3480925","http://www.openwall.com/lists/oss-security/2026/01/07/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","description":"When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."}]},{"artifact":{"id":"c858d6e98e8cab23","cpes":["cpe:2.3:a:file-libs:file-libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:file-libs:file_libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:file_libs:file-libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:file_libs:file_libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:file-libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:file_libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:file:file-libs:5.33-27.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:file:file_libs:5.33-27.el8_10:*:*:*:*:*:*:*"],"name":"file-libs","purl":"pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=rhel-8.10&upstream=file-5.33-27.el8_10.src.rpm","type":"rpm","version":"5.33-27.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"file","version":"5.33-27.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-8906","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"file","version":"5.33-27.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2019-8906","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8906","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8906","date":"2026-11-07","epss":0.00497,"percentile":0.42858}],"risk":0.18389,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2019-8906","description":"A vulnerability has been identified in the File Project, specifically in the do_core_note function within readelf.c of libmagic.a where, an out-of-bounds read, can be exploited by a local attacker using a specially crafted file which could result in a denial of service or leakage of sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2019-8906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":3.6,"impactScore":5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8906","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8906","date":"2026-11-07","epss":0.00497,"percentile":0.42858}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html","https://bugs.astron.com/view.php?id=64","https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f","https://support.apple.com/kb/HT209599","https://support.apple.com/kb/HT209600","https://support.apple.com/kb/HT209601","https://support.apple.com/kb/HT209602","https://usn.ubuntu.com/3911-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-8906","description":"do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32792","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-32792","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32792","cwe":"CWE-125","type":"Secondary","source":"sep@nlnetlabs.nl"},{"cve":"CVE-2026-32792","cwe":"CWE-166","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-32792","date":"2026-11-07","epss":0.00337,"percentile":0.27242}],"risk":0.18366500000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32792","description":"A flaw was found in Unbound. A remote attacker can exploit this vulnerability by sending a specially crafted DNSCrypt query. This malicious query, when processed, causes Unbound to read beyond its allocated memory, leading to a heap overflow. This can result in a denial of service (DoS) by crashing the Unbound service."},"relatedVulnerabilities":[{"id":"CVE-2026-32792","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32792","cwe":"CWE-125","type":"Secondary","source":"sep@nlnetlabs.nl"},{"cve":"CVE-2026-32792","cwe":"CWE-166","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-32792","date":"2026-11-07","epss":0.00337,"percentile":0.27242}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32792","description":"NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32792","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-32792","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32792","cwe":"CWE-125","type":"Secondary","source":"sep@nlnetlabs.nl"},{"cve":"CVE-2026-32792","cwe":"CWE-166","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-32792","date":"2026-11-07","epss":0.00337,"percentile":0.27242}],"risk":0.18366500000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-32792","description":"A flaw was found in Unbound. A remote attacker can exploit this vulnerability by sending a specially crafted DNSCrypt query. This malicious query, when processed, causes Unbound to read beyond its allocated memory, leading to a heap overflow. This can result in a denial of service (DoS) by crashing the Unbound service."},"relatedVulnerabilities":[{"id":"CVE-2026-32792","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32792","cwe":"CWE-125","type":"Secondary","source":"sep@nlnetlabs.nl"},{"cve":"CVE-2026-32792","cwe":"CWE-166","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-32792","date":"2026-11-07","epss":0.00337,"percentile":0.27242}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32792","description":"NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11411","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-11411","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.1,"impactScore":4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11411","cwe":"CWE-349","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2025-11411","date":"2026-11-07","epss":0.0033,"percentile":0.26355}],"risk":0.18314999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11411","description":"A domain hijacking flaw has been discovered in NLNet Lab's Unbound project. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point."},"relatedVulnerabilities":[{"id":"CVE-2025-11411","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11411","cwe":"CWE-349","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2025-11411","date":"2026-11-07","epss":0.0033,"percentile":0.26355}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt","http://www.openwall.com/lists/oss-security/2025/11/26/4","https://lists.debian.org/debian-lts-announce/2025/11/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/11/msg00032.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11411","description":"NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11411","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-11411","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.1,"impactScore":4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11411","cwe":"CWE-349","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2025-11411","date":"2026-11-07","epss":0.0033,"percentile":0.26355}],"risk":0.18314999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-11411","description":"A domain hijacking flaw has been discovered in NLNet Lab's Unbound project. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point."},"relatedVulnerabilities":[{"id":"CVE-2025-11411","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11411","cwe":"CWE-349","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2025-11411","date":"2026-11-07","epss":0.0033,"percentile":0.26355}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt","http://www.openwall.com/lists/oss-security/2025/11/26/4","https://lists.debian.org/debian-lts-announce/2025/11/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/11/msg00032.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11411","description":"NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect."}]},{"artifact":{"id":"84c4e558c80e4b90","cpes":["cpe:2.3:a:libarchive:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libarchive-3.3.3-7.el8_10.src.rpm","type":"rpm","version":"3.3.3-7.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4426","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libarchive","version":"0:3.3.3-7.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4426","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4426","cwe":"CWE-1335","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4426","date":"2026-11-07","epss":0.00317,"percentile":0.24837}],"risk":0.182275,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4426","description":"A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition."},"relatedVulnerabilities":[{"id":"CVE-2026-4426","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4426","cwe":"CWE-1335","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-4426","date":"2026-11-07","epss":0.00317,"percentile":0.24837}],"urls":["https://access.redhat.com/errata/RHSA-2026:8944","https://access.redhat.com/security/cve/CVE-2026-4426","https://bugzilla.redhat.com/show_bug.cgi?id=2449010","https://github.com/libarchive/libarchive/pull/2897"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4426","description":"A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition."}]},{"artifact":{"id":"3daf927dec9eda42","cpes":["cpe:2.3:a:gnutls:gnutls:3.6.16-8.el8_10.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.6.16-8.el8_10.6:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=rhel-8.10&upstream=gnutls-3.6.16-8.el8_10.6.src.rpm","type":"rpm","version":"3.6.16-8.el8_10.6","language":"","licenses":["GPLv3+ and LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5419","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gnutls","version":"0:3.6.16-8.el8_10.6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-5419","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5419","cwe":"CWE-208","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5419","date":"2026-11-07","epss":0.00543,"percentile":0.45857}],"risk":0.18190499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-5419","description":"A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-5419","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5419","cwe":"CWE-208","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5419","date":"2026-11-07","epss":0.00543,"percentile":0.45857}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-5419","https://bugzilla.redhat.com/show_bug.cgi?id=2467686","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-13"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5419","description":"A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure."}]},{"artifact":{"id":"a93b20bd8e26de86","cpes":["cpe:2.3:a:libsolv:libsolv:0.7.20-7.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsolv:0.7.20-7.el8_10:*:*:*:*:*:*:*"],"name":"libsolv","purl":"pkg:rpm/redhat/libsolv@0.7.20-7.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libsolv-0.7.20-7.el8_10.src.rpm","type":"rpm","version":"0.7.20-7.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9149","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libsolv","version":"0:0.7.20-7.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-9149","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9149","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-9149","date":"2026-11-07","epss":0.00312,"percentile":0.24263}],"risk":0.17939999999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-9149","description":"A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-9149","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9149","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-9149","date":"2026-11-07","epss":0.00312,"percentile":0.24263}],"urls":["https://access.redhat.com/errata/RHSA-2026:21333","https://access.redhat.com/errata/RHSA-2026:28236","https://access.redhat.com/errata/RHSA-2026:48818","https://access.redhat.com/security/cve/CVE-2026-9149","https://bugzilla.redhat.com/show_bug.cgi?id=2460380","https://github.com/openSUSE/libsolv/pull/617"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9149","description":"A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS)."}]},{"artifact":{"id":"7099e1b9cc673e8a","cpes":["cpe:2.3:a:redhat:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"0:2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-07","epss":0.00297,"percentile":0.22558}],"risk":0.1782,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84243","description":"A flaw was found in glibc. The library's localization functions fail to properly sanitize directory traversal characters within the LANGUAGE environment variable. A local attacker capable of setting this variable across trust boundaries can force a target program to load a malicious translation file from an arbitrary filesystem location. This issue can lead to arbitrary code execution under the privileges of the running application or cause an application crash, resulting in a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-07","epss":0.00297,"percentile":0.22558}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"f9f2f96854016567","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-07","epss":0.00297,"percentile":0.22558}],"risk":0.1782,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84243","description":"A flaw was found in glibc. The library's localization functions fail to properly sanitize directory traversal characters within the LANGUAGE environment variable. A local attacker capable of setting this variable across trust boundaries can force a target program to load a malicious translation file from an arbitrary filesystem location. This issue can lead to arbitrary code execution under the privileges of the running application or cause an application crash, resulting in a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-07","epss":0.00297,"percentile":0.22558}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"44a10f7911e45aa5","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-07","epss":0.00297,"percentile":0.22558}],"risk":0.1782,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84243","description":"A flaw was found in glibc. The library's localization functions fail to properly sanitize directory traversal characters within the LANGUAGE environment variable. A local attacker capable of setting this variable across trust boundaries can force a target program to load a malicious translation file from an arbitrary filesystem location. This issue can lead to arbitrary code execution under the privileges of the running application or cause an application crash, resulting in a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-07","epss":0.00297,"percentile":0.22558}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"14f406c5bcf8faf4","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.7?arch=x86_64&distro=rhel-8.10&upstream=libxml2-2.9.7-21.el8_10.7.src.rpm","type":"rpm","version":"2.9.7-21.el8_10.7","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0989","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libxml2","version":"0:2.9.7-21.el8_10.7"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0989","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0989","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0989","date":"2026-11-07","epss":0.0053,"percentile":0.45067}],"risk":0.17754999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0989","description":"A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk."},"relatedVulnerabilities":[{"id":"CVE-2026-0989","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0989","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0989","date":"2026-11-07","epss":0.0053,"percentile":0.45067}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0989","https://bugzilla.redhat.com/show_bug.cgi?id=2429933","https://gitlab.gnome.org/GNOME/libxml2/-/issues/998"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0989","description":"A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk."}]},{"artifact":{"id":"bcecf49dfefd132c","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.26.0-21.el8_10?arch=x86_64&distro=rhel-8.10&upstream=sqlite-3.26.0-21.el8_10.src.rpm","type":"rpm","version":"3.26.0-21.el8_10","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.26.0-21.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119374","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"sqlite","version":"3.26.0-21.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-119374","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-07","epss":0.0023,"percentile":0.13921}],"risk":0.17595,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119374","description":"A flaw was found in SQLite. When the Full Text Search (FTS5) extension is enabled and secure-delete mode is active, processing a database containing a corrupted search index triggers a heap-based buffer overflow. An attacker who tricks an application or user into opening a crafted database file can exploit this flaw to execute arbitrary code or cause a Denial of Service (DoS) by crashing the application."},"relatedVulnerabilities":[{"id":"CVE-2026-119374","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-07","epss":0.0023,"percentile":0.13921}],"urls":["https://abraxaslabs.tech/research/sqlite-fts5-securedel","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525","https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/9cd4f9e920","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119374","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1965","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-1965","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1965","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-1965","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1965","date":"2026-11-07","epss":0.00297,"percentile":0.22562}],"risk":0.17522999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1965","description":"A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass."},"relatedVulnerabilities":[{"id":"CVE-2026-1965","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1965","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-1965","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1965","date":"2026-11-07","epss":0.00297,"percentile":0.22562}],"urls":["https://curl.se/docs/CVE-2026-1965.html","https://curl.se/docs/CVE-2026-1965.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1965","description":"libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl's reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API)."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1965","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-1965","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1965","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-1965","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1965","date":"2026-11-07","epss":0.00297,"percentile":0.22562}],"risk":0.17522999999999997,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1965","description":"A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass."},"relatedVulnerabilities":[{"id":"CVE-2026-1965","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1965","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-1965","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1965","date":"2026-11-07","epss":0.00297,"percentile":0.22562}],"urls":["https://curl.se/docs/CVE-2026-1965.html","https://curl.se/docs/CVE-2026-1965.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1965","description":"libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl's reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API)."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42923","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42923","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42923","cwe":"CWE-407","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-42923","date":"2026-11-07","epss":0.00339,"percentile":0.27466}],"risk":0.174585,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42923","description":"A flaw was found in Unbound's DNSSEC validator where the code path for consulting the negative cache for DS records does not honor the limit on NSEC3 hash calculations introduced in version 1.19.1. An adversary who controls a DNSSEC-signed zone can sign NSEC3 records with high iteration counts for child delegations, causing Unbound to perform excessive hash computations while holding a global lock on the negative cache. This temporarily blocks other resolver threads from accessing the negative cache, leading to degraded DNS resolution performance for the duration of the attack."},"relatedVulnerabilities":[{"id":"CVE-2026-42923","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42923","cwe":"CWE-407","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-42923","date":"2026-11-07","epss":0.00339,"percentile":0.27466}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42923","description":"NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable code path with the existing limit for NSEC3 hash calculations."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42923","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42923","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42923","cwe":"CWE-407","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-42923","date":"2026-11-07","epss":0.00339,"percentile":0.27466}],"risk":0.174585,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42923","description":"A flaw was found in Unbound's DNSSEC validator where the code path for consulting the negative cache for DS records does not honor the limit on NSEC3 hash calculations introduced in version 1.19.1. An adversary who controls a DNSSEC-signed zone can sign NSEC3 records with high iteration counts for child delegations, causing Unbound to perform excessive hash computations while holding a global lock on the negative cache. This temporarily blocks other resolver threads from accessing the negative cache, leading to degraded DNS resolution performance for the duration of the attack."},"relatedVulnerabilities":[{"id":"CVE-2026-42923","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42923","cwe":"CWE-407","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-42923","date":"2026-11-07","epss":0.00339,"percentile":0.27466}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42923","description":"NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable code path with the existing limit for NSEC3 hash calculations."}]},{"artifact":{"id":"e390c65fcc1c5000","cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@2.7.0","type":"python","version":"2.7.0","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/METADATA","layerID":"sha256:ee08bcd61791d94f87a8872f390618ce45e47cf924c4292d57689eff006b1944","accessPath":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/RECORD","layerID":"sha256:ee08bcd61791d94f87a8872f390618ce45e47cf924c4292d57689eff006b1944","accessPath":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/RECORD","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gh4c-6fx4-qh6g","versionConstraint":">=2.6.2,<2.8.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"2.7.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-gh4c-6fx4-qh6g","fix":{"state":"fixed","versions":["2.8.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97688","date":"2026-11-07","epss":0.00292,"percentile":0.21874}],"risk":0.17373999999999998,"urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gh4c-6fx4-qh6g","description":"urllib3: Chunked Deflate streaming can enter an infinite loop"},"relatedVulnerabilities":[{"id":"CVE-2026-97688","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97688","date":"2026-11-07","epss":0.00292,"percentile":0.21874}],"urls":["https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97688","description":"urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0."}]},{"artifact":{"id":"c22794ff3ec67fe8","cpes":["cpe:2.3:a:redhat:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.56.4-177.el8_10?arch=x86_64&distro=rhel-8.10&upstream=glib2-2.56.4-177.el8_10.src.rpm","type":"rpm","version":"2.56.4-177.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-32611","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glib2","version":"0:2.56.4-177.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2023-32611","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32611","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-32611","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-32611","date":"2026-11-07","epss":0.00361,"percentile":0.30107}],"risk":0.171475,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2023-32611","description":"A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-32611","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-32611","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-32611","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-32611","date":"2026-11-07","epss":0.00361,"percentile":0.30107}],"urls":["https://access.redhat.com/security/cve/CVE-2023-32611","https://bugzilla.redhat.com/show_bug.cgi?id=2211829","https://gitlab.gnome.org/GNOME/glib/-/issues/2797","https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html","https://security.gentoo.org/glsa/202311-18","https://security.netapp.com/advisory/ntap-20231027-0005/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32611","description":"A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service."}]},{"artifact":{"id":"71c4e7274edbf7e5","cpes":["cpe:2.3:a:libtirpc:libtirpc:1.1.4-12.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libtirpc:1.1.4-12.el8_10:*:*:*:*:*:*:*"],"name":"libtirpc","purl":"pkg:rpm/redhat/libtirpc@1.1.4-12.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libtirpc-1.1.4-12.el8_10.src.rpm","type":"rpm","version":"1.1.4-12.el8_10","language":"","licenses":["SISSL and BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85231","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libtirpc","version":"0:1.1.4-12.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-85231","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-07","epss":0.00297,"percentile":0.225}],"risk":0.17077499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."},"relatedVulnerabilities":[{"id":"CVE-2026-85231","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-07","epss":0.00297,"percentile":0.225}],"urls":["https://access.redhat.com/security/cve/CVE-2026-85231","https://bugzilla.redhat.com/show_bug.cgi?id=2478512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-11-07","epss":0.00329,"percentile":0.26142}],"risk":0.169435,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4873","description":"A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection (via IMAP, SMTP, or POP3) and then making a subsequent request to the same host that requires Transport Layer Security (TLS). Due to incorrect connection reuse, the subsequent request would bypass the TLS requirement, leading to the transmission of sensitive information in cleartext. This vulnerability, categorized as Cleartext Transmission of Sensitive Information (CWE-319), results in information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-4873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-11-07","epss":0.00329,"percentile":0.26142}],"urls":["https://curl.se/docs/CVE-2026-4873.html","https://curl.se/docs/CVE-2026-4873.json","https://hackerone.com/reports/3621851","http://www.openwall.com/lists/oss-security/2026/04/29/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","description":"A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-11-07","epss":0.00329,"percentile":0.26142}],"risk":0.169435,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4873","description":"A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection (via IMAP, SMTP, or POP3) and then making a subsequent request to the same host that requires Transport Layer Security (TLS). Due to incorrect connection reuse, the subsequent request would bypass the TLS requirement, leading to the transmission of sensitive information in cleartext. This vulnerability, categorized as Cleartext Transmission of Sensitive Information (CWE-319), results in information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-4873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-11-07","epss":0.00329,"percentile":0.26142}],"urls":["https://curl.se/docs/CVE-2026-4873.html","https://curl.se/docs/CVE-2026-4873.json","https://hackerone.com/reports/3621851","http://www.openwall.com/lists/oss-security/2026/04/29/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","description":"A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted."}]},{"artifact":{"id":"c22794ff3ec67fe8","cpes":["cpe:2.3:a:redhat:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.56.4-177.el8_10?arch=x86_64&distro=rhel-8.10&upstream=glib2-2.56.4-177.el8_10.src.rpm","type":"rpm","version":"2.56.4-177.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.56.4-178.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-16118","versionConstraint":"< 0:2.56.4-178.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glib2","version":"0:2.56.4-177.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-16118","fix":{"state":"fixed","versions":["0:2.56.4-178.el8_10"],"available":[{"date":"2026-09-12","kind":"first-observed","version":"0:2.56.4-178.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16118","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16118","date":"2026-11-07","epss":0.00277,"percentile":0.20271}],"risk":0.16758499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:66451","link":"https://access.redhat.com/errata/RHSA-2026:66451"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-16118","description":"A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-16118","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16118","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16118","date":"2026-11-07","epss":0.00277,"percentile":0.20271}],"urls":["https://access.redhat.com/errata/RHSA-2026:64799","https://access.redhat.com/errata/RHSA-2026:64800","https://access.redhat.com/errata/RHSA-2026:66451","https://access.redhat.com/errata/RHSA-2026:67956","https://access.redhat.com/errata/RHSA-2026:70636","https://access.redhat.com/errata/RHSA-2026:71403","https://access.redhat.com/errata/RHSA-2026:71404","https://access.redhat.com/errata/RHSA-2026:71405","https://access.redhat.com/errata/RHSA-2026:72394","https://access.redhat.com/errata/RHSA-2026:72395","https://access.redhat.com/errata/RHSA-2026:72399","https://access.redhat.com/errata/RHSA-2026:72470","https://access.redhat.com/errata/RHSA-2026:72475","https://access.redhat.com/errata/RHSA-2026:72476","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:73859","https://access.redhat.com/errata/RHSA-2026:73909","https://access.redhat.com/errata/RHSA-2026:73929","https://access.redhat.com/errata/RHSA-2026:73930","https://access.redhat.com/errata/RHSA-2026:73959","https://access.redhat.com/errata/RHSA-2026:73960","https://access.redhat.com/errata/RHSA-2026:73961","https://access.redhat.com/errata/RHSA-2026:73962","https://access.redhat.com/errata/RHSA-2026:74359","https://access.redhat.com/errata/RHSA-2026:74360","https://access.redhat.com/errata/RHSA-2026:74361","https://access.redhat.com/errata/RHSA-2026:74362","https://access.redhat.com/errata/RHSA-2026:74363","https://access.redhat.com/errata/RHSA-2026:74364","https://access.redhat.com/errata/RHSA-2026:74365","https://access.redhat.com/errata/RHSA-2026:74450","https://access.redhat.com/errata/RHSA-2026:74458","https://access.redhat.com/errata/RHSA-2026:74459","https://access.redhat.com/errata/RHSA-2026:74460","https://access.redhat.com/errata/RHSA-2026:74461","https://access.redhat.com/errata/RHSA-2026:74462","https://access.redhat.com/errata/RHSA-2026:74463","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:74677","https://access.redhat.com/errata/RHSA-2026:74678","https://access.redhat.com/errata/RHSA-2026:74679","https://access.redhat.com/errata/RHSA-2026:74681","https://access.redhat.com/errata/RHSA-2026:74683","https://access.redhat.com/errata/RHSA-2026:74685","https://access.redhat.com/errata/RHSA-2026:74687","https://access.redhat.com/errata/RHSA-2026:74688","https://access.redhat.com/errata/RHSA-2026:74771","https://access.redhat.com/errata/RHSA-2026:75652","https://access.redhat.com/errata/RHSA-2026:75654","https://access.redhat.com/errata/RHSA-2026:75655","https://access.redhat.com/errata/RHSA-2026:75657","https://access.redhat.com/errata/RHSA-2026:75658","https://access.redhat.com/errata/RHSA-2026:75659","https://access.redhat.com/errata/RHSA-2026:75660","https://access.redhat.com/errata/RHSA-2026:76042","https://access.redhat.com/errata/RHSA-2026:79357","https://access.redhat.com/errata/RHSA-2026:80756","https://access.redhat.com/errata/RHSA-2026:81127","https://access.redhat.com/errata/RHSA-2026:82059","https://access.redhat.com/errata/RHSA-2026:82061","https://access.redhat.com/errata/RHSA-2026:82066","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82336","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82368","https://access.redhat.com/errata/RHSA-2026:82371","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82415","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/errata/RHSA-2026:92449","https://access.redhat.com/errata/RHSA-2026:92452","https://access.redhat.com/security/cve/CVE-2026-16118","https://bugzilla.redhat.com/show_bug.cgi?id=2501732","https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16118","description":"A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption."}]},{"artifact":{"id":"bae8d911ef6070fc","cpes":["cpe:2.3:a:redhat:dbus:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*"],"name":"dbus","purl":"pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=dbus-1.12.8-28.el8_10.src.rpm","type":"rpm","version":"1:1.12.8-28.el8_10","language":"","licenses":["(GPLv2+ or AFL) and GPLv2+"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-35512","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"dbus","version":"1:1.12.8-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-35512","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35512","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35512","date":"2026-11-07","epss":0.00331,"percentile":0.26436}],"risk":0.1655,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors."},"relatedVulnerabilities":[{"id":"CVE-2020-35512","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35512","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35512","date":"2026-11-07","epss":0.00331,"percentile":0.26436}],"urls":["https://bugs.gentoo.org/755392","https://bugzilla.redhat.com/show_bug.cgi?id=1909101","https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128","https://security-tracker.debian.org/tracker/CVE-2020-35512"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"}]},{"artifact":{"id":"a4efa6f05ba491f9","cpes":["cpe:2.3:a:dbus-common:dbus-common:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus-common:dbus_common:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus_common:dbus-common:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus_common:dbus_common:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:dbus-common:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:dbus_common:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus-common:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus_common:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*"],"name":"dbus-common","purl":"pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=rhel-8.10&epoch=1&upstream=dbus-1.12.8-28.el8_10.src.rpm","type":"rpm","version":"1:1.12.8-28.el8_10","language":"","licenses":["(GPLv2+ or AFL) and GPLv2+"],"metadata":{"epoch":1,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"dbus","version":"1.12.8-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-35512","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"dbus","version":"1.12.8-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-35512","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35512","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35512","date":"2026-11-07","epss":0.00331,"percentile":0.26436}],"risk":0.1655,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors."},"relatedVulnerabilities":[{"id":"CVE-2020-35512","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35512","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35512","date":"2026-11-07","epss":0.00331,"percentile":0.26436}],"urls":["https://bugs.gentoo.org/755392","https://bugzilla.redhat.com/show_bug.cgi?id=1909101","https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128","https://security-tracker.debian.org/tracker/CVE-2020-35512"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"}]},{"artifact":{"id":"70e1df9a89a184f5","cpes":["cpe:2.3:a:dbus-daemon:dbus-daemon:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus-daemon:dbus_daemon:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus_daemon:dbus-daemon:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus_daemon:dbus_daemon:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:dbus-daemon:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:dbus_daemon:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus-daemon:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus_daemon:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*"],"name":"dbus-daemon","purl":"pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=dbus-1.12.8-28.el8_10.src.rpm","type":"rpm","version":"1:1.12.8-28.el8_10","language":"","licenses":["(GPLv2+ or AFL) and GPLv2+"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"dbus","version":"1.12.8-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-35512","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"dbus","version":"1.12.8-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-35512","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35512","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35512","date":"2026-11-07","epss":0.00331,"percentile":0.26436}],"risk":0.1655,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors."},"relatedVulnerabilities":[{"id":"CVE-2020-35512","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35512","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35512","date":"2026-11-07","epss":0.00331,"percentile":0.26436}],"urls":["https://bugs.gentoo.org/755392","https://bugzilla.redhat.com/show_bug.cgi?id=1909101","https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128","https://security-tracker.debian.org/tracker/CVE-2020-35512"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"}]},{"artifact":{"id":"0a6b331e14279b2c","cpes":["cpe:2.3:a:dbus-libs:dbus-libs:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus-libs:dbus_libs:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus_libs:dbus-libs:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus_libs:dbus_libs:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:dbus-libs:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:dbus_libs:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus-libs:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus_libs:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*"],"name":"dbus-libs","purl":"pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=dbus-1.12.8-28.el8_10.src.rpm","type":"rpm","version":"1:1.12.8-28.el8_10","language":"","licenses":["(GPLv2+ or AFL) and GPLv2+"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"dbus","version":"1.12.8-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-35512","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"dbus","version":"1.12.8-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-35512","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35512","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35512","date":"2026-11-07","epss":0.00331,"percentile":0.26436}],"risk":0.1655,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors."},"relatedVulnerabilities":[{"id":"CVE-2020-35512","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35512","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35512","date":"2026-11-07","epss":0.00331,"percentile":0.26436}],"urls":["https://bugs.gentoo.org/755392","https://bugzilla.redhat.com/show_bug.cgi?id=1909101","https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128","https://security-tracker.debian.org/tracker/CVE-2020-35512"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"}]},{"artifact":{"id":"691459d88ff1c21a","cpes":["cpe:2.3:a:dbus-tools:dbus-tools:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus-tools:dbus_tools:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus_tools:dbus-tools:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus_tools:dbus_tools:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:dbus-tools:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:dbus_tools:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus-tools:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:dbus:dbus_tools:1\\:1.12.8-28.el8_10:*:*:*:*:*:*:*"],"name":"dbus-tools","purl":"pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=dbus-1.12.8-28.el8_10.src.rpm","type":"rpm","version":"1:1.12.8-28.el8_10","language":"","licenses":["(GPLv2+ or AFL) and GPLv2+"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"dbus","version":"1.12.8-28.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-35512","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"dbus","version":"1.12.8-28.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2020-35512","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35512","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35512","date":"2026-11-07","epss":0.00331,"percentile":0.26436}],"risk":0.1655,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors."},"relatedVulnerabilities":[{"id":"CVE-2020-35512","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35512","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35512","date":"2026-11-07","epss":0.00331,"percentile":0.26436}],"urls":["https://bugs.gentoo.org/755392","https://bugzilla.redhat.com/show_bug.cgi?id=1909101","https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128","https://security-tracker.debian.org/tracker/CVE-2020-35512"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"}]},{"artifact":{"id":"84c4e558c80e4b90","cpes":["cpe:2.3:a:libarchive:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libarchive-3.3.3-7.el8_10.src.rpm","type":"rpm","version":"3.3.3-7.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-25724","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libarchive","version":"0:3.3.3-7.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-25724","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4,"impactScore":2.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25724","cwe":"CWE-252","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-25724","date":"2026-11-07","epss":0.00367,"percentile":0.30758}],"risk":0.16515,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-25724","description":"A flaw was found in the libarchive package. Affected versions of libarchive do not check a strftime return value, which can lead to a denial of service or unspecified other impacts via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale."},"relatedVulnerabilities":[{"id":"CVE-2025-25724","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4,"impactScore":2.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25724","cwe":"CWE-252","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-25724","date":"2026-11-07","epss":0.00367,"percentile":0.30758}],"urls":["https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92","https://github.com/Ekkosun/pocs/blob/main/bsdtarbug","https://github.com/libarchive/libarchive/blob/b439d586f53911c84be5e380445a8a259e19114c/tar/util.c#L751-L752"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25724","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale."}]},{"artifact":{"id":"45c8f2a88ad57c26","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.2.20-4.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.2.20-4.el8_10:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gnupg2-2.2.20-4.el8_10.src.rpm","type":"rpm","version":"2.2.20-4.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-24883","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gnupg2","version":"0:2.2.20-4.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-24883","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24883","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-24883","date":"2026-11-07","epss":0.00486,"percentile":0.42138}],"risk":0.16280999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-24883","description":"A flaw was found in GnuPG. A remote attacker could provide a specially crafted long signature packet that, when processed, causes the application to crash. This vulnerability leads to a denial of service (DoS), making the GnuPG application unavailable to legitimate users."},"relatedVulnerabilities":[{"id":"CVE-2026-24883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24883","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-24883","date":"2026-11-07","epss":0.00486,"percentile":0.42138}],"urls":["https://dev.gnupg.org/T8049","https://www.openwall.com/lists/oss-security/2026/01/27/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24883","description":"In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash)."}]},{"artifact":{"id":"7099e1b9cc673e8a","cpes":["cpe:2.3:a:redhat:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"0:2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-07","epss":0.00315,"percentile":0.24568}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-07","epss":0.00315,"percentile":0.24568}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"f9f2f96854016567","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-07","epss":0.00315,"percentile":0.24568}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-07","epss":0.00315,"percentile":0.24568}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"44a10f7911e45aa5","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-07","epss":0.00315,"percentile":0.24568}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-8674","description":"A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-07","epss":0.00315,"percentile":0.24568}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"93eed475e569196b","cpes":["cpe:2.3:a:platform-python-pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python-pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python_pip:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python-pip:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python_pip:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"platform-python-pip","purl":"pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13346","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-13346","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":5.9,"impactScore":4.8,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13346","cwe":"CWE-36","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-13346","date":"2026-11-07","epss":0.00292,"percentile":0.21939}],"risk":0.15914,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13346","description":"A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to arbitrary locations on the system, potentially leading to system compromise. This vulnerability primarily affects users utilizing the `pip download` command with the `--only-binary` option."},"relatedVulnerabilities":[{"id":"CVE-2026-13346","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13346","cwe":"CWE-36","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-13346","date":"2026-11-07","epss":0.00292,"percentile":0.21939}],"urls":["https://github.com/pypa/pip/pull/14110","https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/","http://www.openwall.com/lists/oss-security/2026/07/29/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13346","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time."}]},{"artifact":{"id":"fa83cdeeda4e9e6a","cpes":["cpe:2.3:a:python3-pip-wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip-wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip_wheel:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3-pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3_pip:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-pip-wheel:9.0.3-24.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_pip_wheel:9.0.3-24.el8:*:*:*:*:*:*:*"],"name":"python3-pip-wheel","purl":"pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=rhel-8.10&upstream=python-pip-9.0.3-24.el8.src.rpm","type":"rpm","version":"9.0.3-24.el8","language":"","licenses":["MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python-pip","version":"9.0.3-24.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13346","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python-pip","version":"9.0.3-24.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-13346","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":5.9,"impactScore":4.8,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13346","cwe":"CWE-36","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-13346","date":"2026-11-07","epss":0.00292,"percentile":0.21939}],"risk":0.15914,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-13346","description":"A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to arbitrary locations on the system, potentially leading to system compromise. This vulnerability primarily affects users utilizing the `pip download` command with the `--only-binary` option."},"relatedVulnerabilities":[{"id":"CVE-2026-13346","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13346","cwe":"CWE-36","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-13346","date":"2026-11-07","epss":0.00292,"percentile":0.21939}],"urls":["https://github.com/pypa/pip/pull/14110","https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/","http://www.openwall.com/lists/oss-security/2026/07/29/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13346","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84783","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-84783","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84783","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84783","date":"2026-11-07","epss":0.0029,"percentile":0.21659}],"risk":0.15805,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84783","description":"A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by initiating concurrent connections to a multi-threaded Transport Layer Security (TLS) client or server verifying certificates. Due to improper synchronization when multiple threads simultaneously decode and cache certificate extensions for a shared Certificate Authority (CA) certificate, cached memory can be freed while still in use by another thread. This use-after-free condition results in an invalid memory read, causing the application to crash."},"relatedVulnerabilities":[{"id":"CVE-2026-84783","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84783","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84783","date":"2026-11-07","epss":0.0029,"percentile":0.21659}],"urls":["https://github.com/openssl/openssl/commit/de97a1a54f43edefd43b5084ecac54ecadb33081","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84783","description":"Issue summary: The first concurrent use of the same X.509 certificate by\nseveral threads may cause its cached extension data to be freed while\nanother thread is still using it.\n\nImpact summary: A remote, unauthenticated peer could crash a multi-threaded\nTLS client, or a multi-threaded TLS server that requests client\ncertificates, if the first certificate chains built to the same trusted CA\ncertificate are built by several connections at the same time. This is a\nuse-after-free read, which is likely to crash the process, resulting in a\nDenial of Service.\n\nCWE: CWE-416: Use After Free\n\nDescription: OpenSSL caches the decoded values of a certificate's X.509v3\nextensions inside the X509 object the first time they are needed. In\nOpenSSL 4.0 this cache is built in two phases: the extension values are\ncomputed while holding a read lock on the certificate, and the results are\nthen installed into the certificate under a write lock. Because a read lock\ndoes not exclude other readers, several threads can compute the cache for\nthe same certificate at the same time. Each thread that subsequently\nacquires the write lock installs its own results and frees the values\ninstalled by the thread before it, even though that earlier thread has\nalready marked the cache as complete and may have returned pointers into it\nto its caller. A caller still using those pointers then reads freed memory.\n\nAny certificate shared between threads is exposed the first time its\nextensions are decoded. In TLS the certificates at risk are the trusted CA\ncertificates supplied for chain verification, by whatever means, since these\nare shared by every connection and their extensions are decoded and cached\nthe first time a chain is built to them. Certificates sent by the peer are\ndecoded separately for each connection and are not shared, so they are not\naffected. In a TLS client verifying server certificates, or a TLS server\nthat requests and verifies client certificates, the use-after-free could\nonly occur if the first chains built to the same trusted CA are built by\nseveral connections at the same time.\n\nFIPS impact: no\nThe FIPS module is not affected as X.509 certificate handling is outside\nof the OpenSSL FIPS module boundary.\n\nOpenSSL 4.0 is vulnerable to this issue.\n\nOpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\n\nThis issue was reported on 27 August 2026 by Tim Becker (Xint.io) and\nindependently in a public report on 31 August 2026 by aydinmercan.\n\nThe fix has been developed by Bob Beck.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Tim Becker (Xint.io), aydinmercan\nFixed by: Bob Beck"}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84783","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-84783","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84783","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84783","date":"2026-11-07","epss":0.0029,"percentile":0.21659}],"risk":0.15805,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-84783","description":"A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by initiating concurrent connections to a multi-threaded Transport Layer Security (TLS) client or server verifying certificates. Due to improper synchronization when multiple threads simultaneously decode and cache certificate extensions for a shared Certificate Authority (CA) certificate, cached memory can be freed while still in use by another thread. This use-after-free condition results in an invalid memory read, causing the application to crash."},"relatedVulnerabilities":[{"id":"CVE-2026-84783","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84783","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84783","date":"2026-11-07","epss":0.0029,"percentile":0.21659}],"urls":["https://github.com/openssl/openssl/commit/de97a1a54f43edefd43b5084ecac54ecadb33081","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84783","description":"Issue summary: The first concurrent use of the same X.509 certificate by\nseveral threads may cause its cached extension data to be freed while\nanother thread is still using it.\n\nImpact summary: A remote, unauthenticated peer could crash a multi-threaded\nTLS client, or a multi-threaded TLS server that requests client\ncertificates, if the first certificate chains built to the same trusted CA\ncertificate are built by several connections at the same time. This is a\nuse-after-free read, which is likely to crash the process, resulting in a\nDenial of Service.\n\nCWE: CWE-416: Use After Free\n\nDescription: OpenSSL caches the decoded values of a certificate's X.509v3\nextensions inside the X509 object the first time they are needed. In\nOpenSSL 4.0 this cache is built in two phases: the extension values are\ncomputed while holding a read lock on the certificate, and the results are\nthen installed into the certificate under a write lock. Because a read lock\ndoes not exclude other readers, several threads can compute the cache for\nthe same certificate at the same time. Each thread that subsequently\nacquires the write lock installs its own results and frees the values\ninstalled by the thread before it, even though that earlier thread has\nalready marked the cache as complete and may have returned pointers into it\nto its caller. A caller still using those pointers then reads freed memory.\n\nAny certificate shared between threads is exposed the first time its\nextensions are decoded. In TLS the certificates at risk are the trusted CA\ncertificates supplied for chain verification, by whatever means, since these\nare shared by every connection and their extensions are decoded and cached\nthe first time a chain is built to them. Certificates sent by the peer are\ndecoded separately for each connection and are not shared, so they are not\naffected. In a TLS client verifying server certificates, or a TLS server\nthat requests and verifies client certificates, the use-after-free could\nonly occur if the first chains built to the same trusted CA are built by\nseveral connections at the same time.\n\nFIPS impact: no\nThe FIPS module is not affected as X.509 certificate handling is outside\nof the OpenSSL FIPS module boundary.\n\nOpenSSL 4.0 is vulnerable to this issue.\n\nOpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\n\nThis issue was reported on 27 August 2026 by Tim Becker (Xint.io) and\nindependently in a public report on 31 August 2026 by aydinmercan.\n\nThe fix has been developed by Bob Beck.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Tim Becker (Xint.io), aydinmercan\nFixed by: Bob Beck"}]},{"artifact":{"id":"bcecf49dfefd132c","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.26.0-21.el8_10?arch=x86_64&distro=rhel-8.10&upstream=sqlite-3.26.0-21.el8_10.src.rpm","type":"rpm","version":"3.26.0-21.el8_10","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.26.0-21.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-70873","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"sqlite","version":"3.26.0-21.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-70873","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-70873","cwe":"CWE-244","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-70873","date":"2026-11-07","epss":0.005,"percentile":0.43105}],"risk":0.15749999999999997,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-70873","description":"A flaw was found in SQLite. This information disclosure vulnerability exists within the zipfile extension, specifically in the zipfileInflate function. A remote attacker could exploit this by providing a specially crafted ZIP file. Successful exploitation could lead to the disclosure of sensitive heap memory information."},"relatedVulnerabilities":[{"id":"CVE-2025-70873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-70873","cwe":"CWE-244","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-70873","date":"2026-11-07","epss":0.005,"percentile":0.43105}],"urls":["https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054","https://sqlite.org/forum/forumpost/761eac3c82","https://sqlite.org/src/info/3d459f1fb1bd1b5e","https://cert-portal.siemens.com/productcert/html/ssa-765416.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-70873","description":"An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file."}]},{"artifact":{"id":"c22794ff3ec67fe8","cpes":["cpe:2.3:a:redhat:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.56.4-177.el8_10?arch=x86_64&distro=rhel-8.10&upstream=glib2-2.56.4-177.el8_10.src.rpm","type":"rpm","version":"2.56.4-177.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1484","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glib2","version":"0:2.56.4-177.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-1484","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1484","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1484","date":"2026-11-07","epss":0.00341,"percentile":0.27803}],"risk":0.15686,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1484","description":"A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably."},"relatedVulnerabilities":[{"id":"CVE-2026-1484","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1484","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1484","date":"2026-11-07","epss":0.00341,"percentile":0.27803}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1484","https://bugzilla.redhat.com/show_bug.cgi?id=2433259","https://gitlab.gnome.org/GNOME/glib/-/issues/3870","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1484","description":"A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably."}]},{"artifact":{"id":"e390c65fcc1c5000","cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@2.7.0","type":"python","version":"2.7.0","language":"python","licenses":["MIT"],"locations":[{"path":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/METADATA","layerID":"sha256:ee08bcd61791d94f87a8872f390618ce45e47cf924c4292d57689eff006b1944","accessPath":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/RECORD","layerID":"sha256:ee08bcd61791d94f87a8872f390618ce45e47cf924c4292d57689eff006b1944","accessPath":"/usr/local/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/RECORD","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8988-9cw3-xx77","versionConstraint":">=1.26.0,<2.8.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"2.7.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8988-9cw3-xx77","fix":{"state":"fixed","versions":["2.8.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97687","cwe":"CWE-440","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97687","date":"2026-11-07","epss":0.00206,"percentile":0.10707}],"risk":0.15553,"urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8988-9cw3-xx77","description":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden"},"relatedVulnerabilities":[{"id":"CVE-2026-97687","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97687","cwe":"CWE-440","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97687","date":"2026-11-07","epss":0.00206,"percentile":0.10707}],"urls":["https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0."}]},{"artifact":{"id":"3daf927dec9eda42","cpes":["cpe:2.3:a:gnutls:gnutls:3.6.16-8.el8_10.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.6.16-8.el8_10.6:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=rhel-8.10&upstream=gnutls-3.6.16-8.el8_10.6.src.rpm","type":"rpm","version":"3.6.16-8.el8_10.6","language":"","licenses":["GPLv3+ and LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88647","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gnutls","version":"0:3.6.16-8.el8_10.6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-88647","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88647","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88647","date":"2026-11-07","epss":0.0024,"percentile":0.1515}],"risk":0.1488,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-88647","description":"A flaw was found in GnuTLS. This vulnerability can lead to information disclosure by allowing an attacker to bypass certificate hostname verification. A remote attacker presenting a crafted certificate can circumvent the Common Name fallback check, enabling them to eavesdrop on or intercept encrypted network communications."},"relatedVulnerabilities":[{"id":"CVE-2026-88647","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88647","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88647","date":"2026-11-07","epss":0.0024,"percentile":0.1515}],"urls":["https://gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642","https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md","https://gitlab.com/gnutls/gnutls/-/issues/1802","https://gitlab.com/gnutls/gnutls/-/work_items/1965","https://github.com/lkloliver/poc/tree/main/CVE-2026-88647"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88647","description":"GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."}]},{"artifact":{"id":"1ed86a8e00e9ac03","cpes":["cpe:2.3:a:libzstd:libzstd:1.4.4-1.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libzstd:1.4.4-1.el8:*:*:*:*:*:*:*"],"name":"libzstd","purl":"pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=rhel-8.10&upstream=zstd-1.4.4-1.el8.src.rpm","type":"rpm","version":"1.4.4-1.el8","language":"","licenses":["BSD and GPLv2"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zstd","version":"1.4.4-1.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-24032","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"zstd","version":"1.4.4-1.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2021-24032","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-24032","cwe":"CWE-277","type":"Secondary","source":"cve-assign@fb.com"},{"cve":"CVE-2021-24032","cwe":"CWE-276","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-24032","date":"2026-11-07","epss":0.00348,"percentile":0.28654}],"risk":0.1479,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2021-24032","description":"A flaw was found in zstd. While the final file mode is reflective of the input file, when compressing or uncompressing, the file can temporarily gain greater permissions than the input and potentially leading to security issues (especially if large files are being handled)."},"relatedVulnerabilities":[{"id":"CVE-2021-24032","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-24032","cwe":"CWE-277","type":"Secondary","source":"cve-assign@fb.com"},{"cve":"CVE-2021-24032","cwe":"CWE-276","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-24032","date":"2026-11-07","epss":0.00348,"percentile":0.28654}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519","https://github.com/facebook/zstd/issues/2491","https://www.facebook.com/security/advisories/cve-2021-24032"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-24032","description":"Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties."}]},{"artifact":{"id":"bcecf49dfefd132c","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.26.0-21.el8_10?arch=x86_64&distro=rhel-8.10&upstream=sqlite-3.26.0-21.el8_10.src.rpm","type":"rpm","version":"3.26.0-21.el8_10","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.26.0-21.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0232","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"sqlite","version":"3.26.0-21.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-0232","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0232","date":"2026-11-07","epss":0.00381,"percentile":0.32325}],"risk":0.146685,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-0232","description":"A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-0232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0232","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0232","date":"2026-11-07","epss":0.00381,"percentile":0.32325}],"urls":["https://access.redhat.com/security/cve/CVE-2024-0232","https://bugzilla.redhat.com/show_bug.cgi?id=2243754","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/","https://security.netapp.com/advisory/ntap-20240315-0007/","https://cert-portal.siemens.com/productcert/html/ssa-000297.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0232","description":"A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114583","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-114583","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-07","epss":0.00261,"percentile":0.18009}],"risk":0.14616,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-114583","description":"A flaw was found in Python's tarfile.tar_filter. Crafted link entries in a tar archive, including symlinks with empty or directory-like names, can redirect later archive members outside the intended extraction directory. An application that extracts an untrusted archive with the tar filter could write or overwrite files outside that directory with the permissions of the extracting process."},"relatedVulnerabilities":[{"id":"CVE-2026-114583","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-07","epss":0.00261,"percentile":0.18009}],"urls":["https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5","https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0","https://github.com/python/cpython/issues/160097","https://github.com/python/cpython/pull/160098","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114583","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-114583","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-07","epss":0.00261,"percentile":0.18009}],"risk":0.14616,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-114583","description":"A flaw was found in Python's tarfile.tar_filter. Crafted link entries in a tar archive, including symlinks with empty or directory-like names, can redirect later archive members outside the intended extraction directory. An application that extracts an untrusted archive with the tar filter could write or overwrite files outside that directory with the permissions of the extracting process."},"relatedVulnerabilities":[{"id":"CVE-2026-114583","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-07","epss":0.00261,"percentile":0.18009}],"urls":["https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5","https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0","https://github.com/python/cpython/issues/160097","https://github.com/python/cpython/pull/160098","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."}]},{"artifact":{"id":"908ac03c9fe48527","cpes":["cpe:2.3:a:coreutils-single:coreutils-single:8.30-20.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-single:coreutils_single:8.30-20.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_single:coreutils-single:8.30-20.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_single:coreutils_single:8.30-20.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-single:8.30-20.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_single:8.30-20.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:coreutils-single:8.30-20.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:coreutils_single:8.30-20.el8_10:*:*:*:*:*:*:*"],"name":"coreutils-single","purl":"pkg:rpm/redhat/coreutils-single@8.30-20.el8_10?arch=x86_64&distro=rhel-8.10&upstream=coreutils-8.30-20.el8_10.src.rpm","type":"rpm","version":"8.30-20.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils","version":"8.30-20.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:8.30-21.el8_10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5278","versionConstraint":"< 0:8.30-21.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"coreutils","version":"8.30-20.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-5278","fix":{"state":"fixed","versions":["0:8.30-21.el8_10"],"available":[{"date":"2026-09-23","kind":"first-observed","version":"0:8.30-21.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5278","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5278","date":"2026-11-07","epss":0.0031,"percentile":0.24}],"risk":0.1457,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:69964","link":"https://access.redhat.com/errata/RHSA-2026:69964"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5278","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data."},"relatedVulnerabilities":[{"id":"CVE-2025-5278","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5278","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5278","date":"2026-11-07","epss":0.0031,"percentile":0.24}],"urls":["https://access.redhat.com/errata/RHSA-2026:28911","https://access.redhat.com/errata/RHSA-2026:33124","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:33612","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:46836","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:69964","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2025-5278","https://bugzilla.redhat.com/show_bug.cgi?id=2368764","https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507","http://www.openwall.com/lists/oss-security/2025/05/27/2","http://www.openwall.com/lists/oss-security/2025/05/29/1","http://www.openwall.com/lists/oss-security/2025/05/29/2","https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14","https://security-tracker.debian.org/tracker/CVE-2025-5278"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5278","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data."}]},{"artifact":{"id":"c22794ff3ec67fe8","cpes":["cpe:2.3:a:redhat:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.56.4-177.el8_10?arch=x86_64&distro=rhel-8.10&upstream=glib2-2.56.4-177.el8_10.src.rpm","type":"rpm","version":"2.56.4-177.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0988","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glib2","version":"0:2.56.4-177.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0988","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0988","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0988","date":"2026-11-07","epss":0.00434,"percentile":0.3795}],"risk":0.14539,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0988","description":"A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-0988","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0988","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0988","date":"2026-11-07","epss":0.00434,"percentile":0.3795}],"urls":["https://access.redhat.com/errata/RHSA-2026:7461","https://access.redhat.com/security/cve/CVE-2026-0988","https://bugzilla.redhat.com/show_bug.cgi?id=2429886","https://gitlab.gnome.org/GNOME/glib/-/issues/3851"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0988","description":"A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"c22794ff3ec67fe8","cpes":["cpe:2.3:a:redhat:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:glib2:glib2:2.56.4-177.el8_10:*:*:*:*:*:*:*"],"name":"glib2","purl":"pkg:rpm/redhat/glib2@2.56.4-177.el8_10?arch=x86_64&distro=rhel-8.10&upstream=glib2-2.56.4-177.el8_10.src.rpm","type":"rpm","version":"2.56.4-177.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-7039","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glib2","version":"0:2.56.4-177.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-7039","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7039","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7039","date":"2026-11-07","epss":0.00434,"percentile":0.37874}],"risk":0.14539,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-7039","description":"A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations."},"relatedVulnerabilities":[{"id":"CVE-2025-7039","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7039","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7039","date":"2026-11-07","epss":0.00434,"percentile":0.37874}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7039","https://bugzilla.redhat.com/show_bug.cgi?id=2392423","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7039","description":"A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42960","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42960","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42960","cwe":"CWE-349","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-42960","date":"2026-11-07","epss":0.00262,"percentile":0.18083}],"risk":0.14279000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42960","description":"A flaw was found in Unbound's handling of DNS reply messages, complementing the earlier CVE-2025-11411 fix. Unbound accepts and caches address records from the additional section of DNS replies when they accompany authority section RRSets other than NS (such as MX records). A malicious actor who can inject crafted DNS responses—via packet spoofing or fragmentation attacks—can exploit this to poison Unbound's cache with attacker-controlled address records, potentially redirecting DNS resolution for affected domains."},"relatedVulnerabilities":[{"id":"CVE-2026-42960","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","metrics":{"baseScore":10,"impactScore":5.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42960","cwe":"CWE-349","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-42960","date":"2026-11-07","epss":0.00262,"percentile":0.18083}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42960","description":"NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42960","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-42960","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42960","cwe":"CWE-349","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-42960","date":"2026-11-07","epss":0.00262,"percentile":0.18083}],"risk":0.14279000000000003,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-42960","description":"A flaw was found in Unbound's handling of DNS reply messages, complementing the earlier CVE-2025-11411 fix. Unbound accepts and caches address records from the additional section of DNS replies when they accompany authority section RRSets other than NS (such as MX records). A malicious actor who can inject crafted DNS responses—via packet spoofing or fragmentation attacks—can exploit this to poison Unbound's cache with attacker-controlled address records, potentially redirecting DNS resolution for affected domains."},"relatedVulnerabilities":[{"id":"CVE-2026-42960","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","metrics":{"baseScore":10,"impactScore":5.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42960","cwe":"CWE-349","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-42960","date":"2026-11-07","epss":0.00262,"percentile":0.18083}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42960","description":"NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411."}]},{"artifact":{"id":"3fa5e9a1b5f18fed","cpes":["cpe:2.3:a:redhat:pcre2:10.32-3.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.32-3.el8_6:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=rhel-8.10&upstream=pcre2-10.32-3.el8_6.src.rpm","type":"rpm","version":"10.32-3.el8_6","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:10.32-4.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"< 0:10.32-4.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"pcre2","version":"0:10.32-3.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"fixed","versions":["0:10.32-4.el8_10"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:10.32-4.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-11-07","epss":0.00247,"percentile":0.1604}],"risk":0.14202499999999998,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:81613","link":"https://access.redhat.com/errata/RHSA-2026:81613"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89158","description":"A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the `pcre2_compile_32` function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-11-07","epss":0.00247,"percentile":0.1604}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."}]},{"artifact":{"id":"4e1a723b1c308bef","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","layerID":"sha256:6280d307621e9b14e453ed551050c32f1a818b63c78c53c4074beab0867192c2","accessPath":"/usr/share/java/cp-base-new/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-343h-94h5-c4wr","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-343h-94h5-c4wr","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106449","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106449","date":"2026-11-07","epss":0.00423,"percentile":0.36818}],"risk":0.141705,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr","https://nvd.nist.gov/vuln/detail/CVE-2026-106449","https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-343h-94h5-c4wr","description":"yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError"},"relatedVulnerabilities":[{"id":"CVE-2026-106449","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106449","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106449","date":"2026-11-07","epss":0.00423,"percentile":0.36818}],"urls":["https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106449","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"9d4b5e84721dd1cf","cpes":["cpe:2.3:a:lz4-java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4-java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4_java:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:org.lz4:lz4_java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4-java:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:lz4:lz4_java:1.11.1:*:*:*:*:*:*:*"],"name":"lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java@1.11.1","type":"java-archive","version":"1.11.1","language":"java","licenses":["\"Apache License, Version 2.0\";link=\"https://www.apache.org/licenses/LICENSE-2.0\""],"metadata":{"pomGroupID":"at.yawk.lz4","virtualPath":"/usr/share/java/kafka/lz4-java-1.11.1.jar","manifestName":"","pomArtifactID":"lz4-java","archiveDigests":[{"value":"140124bf632168cef73cf9ce80477dced52b2443","algorithm":"sha1"}]},"locations":[{"path":"/usr/share/java/kafka/lz4-java-1.11.1.jar","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/usr/share/java/kafka/lz4-java-1.11.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-343h-94h5-c4wr","versionConstraint":"<=1.11.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"at.yawk.lz4:lz4-java","version":"1.11.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-343h-94h5-c4wr","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106449","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106449","date":"2026-11-07","epss":0.00423,"percentile":0.36818}],"risk":0.141705,"urls":["https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr","https://nvd.nist.gov/vuln/detail/CVE-2026-106449","https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-343h-94h5-c4wr","description":"yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError"},"relatedVulnerabilities":[{"id":"CVE-2026-106449","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106449","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106449","date":"2026-11-07","epss":0.00423,"percentile":0.36818}],"urls":["https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106449","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-13034","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-13034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-11-07","epss":0.00239,"percentile":0.15015}],"risk":0.14101,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-13034","description":"A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server's identity."},"relatedVulnerabilities":[{"id":"CVE-2025-13034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-11-07","epss":0.00239,"percentile":0.15015}],"urls":["https://curl.se/docs/CVE-2025-13034.html","https://curl.se/docs/CVE-2025-13034.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","description":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13034","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-13034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-11-07","epss":0.00239,"percentile":0.15015}],"risk":0.14101,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-13034","description":"A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server's identity."},"relatedVulnerabilities":[{"id":"CVE-2025-13034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-13034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13034","date":"2026-11-07","epss":0.00239,"percentile":0.15015}],"urls":["https://curl.se/docs/CVE-2025-13034.html","https://curl.se/docs/CVE-2025-13034.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","description":"When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."}]},{"artifact":{"id":"82d2bf81319896e9","cpes":["cpe:2.3:a:shadow-utils:shadow-utils:2\\:4.6-23.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:shadow-utils:shadow_utils:2\\:4.6-23.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:shadow_utils:shadow-utils:2\\:4.6-23.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:shadow_utils:shadow_utils:2\\:4.6-23.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:shadow-utils:2\\:4.6-23.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:shadow_utils:2\\:4.6-23.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:shadow:shadow-utils:2\\:4.6-23.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:shadow:shadow_utils:2\\:4.6-23.el8_10:*:*:*:*:*:*:*"],"name":"shadow-utils","purl":"pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=rhel-8.10&epoch=2&upstream=shadow-utils-4.6-23.el8_10.src.rpm","type":"rpm","version":"2:4.6-23.el8_10","language":"","licenses":["BSD and GPLv2+"],"metadata":{"epoch":2,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"shadow-utils","version":"2:4.6-23.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-07","epss":0.00426,"percentile":0.37142}],"risk":0.14057999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-56433","description":"A flaw was found in shadow-utils. Affected versions of shadow-utils establish a default /etc/subuid behavior, for example, uid 100000 through 165535 for the first user account, that can conflict with the uids of users defined on locally administered networks. This issue potentially leads to account takeover by leveraging newuidmap for access to an NFS home directory or same-host resources for remote logins by these local network users."},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-07","epss":0.00426,"percentile":0.37142}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"e2e881f8f7678b49","cpes":["cpe:2.3:a:libmodulemd:libmodulemd:2.13.0-1.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmodulemd:2.13.0-1.el8:*:*:*:*:*:*:*"],"name":"libmodulemd","purl":"pkg:rpm/redhat/libmodulemd@2.13.0-1.el8?arch=x86_64&distro=rhel-8.10&upstream=libmodulemd-2.13.0-1.el8.src.rpm","type":"rpm","version":"2.13.0-1.el8","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92822","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libmodulemd","version":"0:2.13.0-1.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-92822","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92822","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-92822","date":"2026-11-07","epss":0.00251,"percentile":0.16607}],"risk":0.14056000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-92822","description":"A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-92822","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92822","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-92822","date":"2026-11-07","epss":0.00251,"percentile":0.16607}],"urls":["https://access.redhat.com/security/cve/CVE-2026-92822","https://bugzilla.redhat.com/show_bug.cgi?id=2479002","https://github.com/advisories/GHSA-85r9-7wj5-x6x5","https://github.com/fedora-modularity/libmodulemd/pull/645"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92822","description":"A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service."}]},{"artifact":{"id":"5c842fe0f64f5a4c","cpes":["cpe:2.3:a:libssh:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh","purl":"pkg:rpm/redhat/libssh@0.9.6-17.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0968","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0:0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0968","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0968","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0968","date":"2026-11-07","epss":0.00459,"percentile":0.40012}],"risk":0.139995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0968","description":"A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes."},"relatedVulnerabilities":[{"id":"CVE-2026-0968","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0968","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0968","date":"2026-11-07","epss":0.00459,"percentile":0.40012}],"urls":["https://access.redhat.com/errata/RHSA-2026:18160","https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2026-0968","https://bugzilla.redhat.com/show_bug.cgi?id=2436982","https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0968","description":"A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes."}]},{"artifact":{"id":"bd8c4541a903d30b","cpes":["cpe:2.3:a:libssh-config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh-config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh-config","purl":"pkg:rpm/redhat/libssh-config@0.9.6-17.el8_10?arch=noarch&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libssh","version":"0.9.6-17.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0968","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0968","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0968","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0968","date":"2026-11-07","epss":0.00459,"percentile":0.40012}],"risk":0.139995,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0968","description":"A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes."},"relatedVulnerabilities":[{"id":"CVE-2026-0968","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0968","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0968","date":"2026-11-07","epss":0.00459,"percentile":0.40012}],"urls":["https://access.redhat.com/errata/RHSA-2026:18160","https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2026-0968","https://bugzilla.redhat.com/show_bug.cgi?id=2436982","https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0968","description":"A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44608","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-44608","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44608","cwe":"CWE-413","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-44608","date":"2026-11-07","epss":0.00255,"percentile":0.17232}],"risk":0.13897500000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44608","description":"A flaw was found in Unbound. When operating in a multi-threaded configuration with specific Response Policy Zones (RPZ) using 'rpz-nsip' or 'rpz-nsdname' triggers, a locking inconsistency during an RPZ zone transfer (XFR) reload can occur. This timing issue may allow an adversary to trigger a heap use-after-free vulnerability, leading to a system crash and a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-44608","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44608","cwe":"CWE-413","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-44608","date":"2026-11-07","epss":0.00255,"percentile":0.17232}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44608","description":"NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44608","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-44608","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44608","cwe":"CWE-413","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-44608","date":"2026-11-07","epss":0.00255,"percentile":0.17232}],"risk":0.13897500000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44608","description":"A flaw was found in Unbound. When operating in a multi-threaded configuration with specific Response Policy Zones (RPZ) using 'rpz-nsip' or 'rpz-nsdname' triggers, a locking inconsistency during an RPZ zone transfer (XFR) reload can occur. This timing issue may allow an adversary to trigger a heap use-after-free vulnerability, leading to a system crash and a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-44608","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44608","cwe":"CWE-413","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-44608","date":"2026-11-07","epss":0.00255,"percentile":0.17232}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44608","description":"NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code."}]},{"artifact":{"id":"796569fea39cc9f9","cpes":["cpe:2.3:a:libblkid:libblkid:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.32.1-48.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"9c525777ab67163b","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.32.1-48.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"cd8c90c0af5b2eb1","cpes":["cpe:2.3:a:libmount:libmount:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.32.1-48.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"11f35d4d876e70d8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.32.1-48.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"b4549ca66835b489","cpes":["cpe:2.3:a:libuuid:libuuid:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.32.1-48.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"bd8a0a396c843f50","cpes":["cpe:2.3:a:util-linux:util-linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["GPLv2 and GPLv2+ and LGPLv2+ and BSD with advertising and Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53615","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"0:2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53615","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"risk":0.13795,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53615","description":"A flaw was found in util-linux. An integer overflow vulnerability in the partition parsing library (libblkid) fails to properly enforce boundary checks on extended partition entries. A local attacker could exploit this flaw by presenting a crafted disk image or removable storage device for probing, causing false partition boundaries to be reported that overlap the Master Boot Record (MBR). This directly compromises the integrity of reported disk partition metadata and may result in unintended data corruption if downstream system tools act on the incorrect layout."},"relatedVulnerabilities":[{"id":"CVE-2026-53615","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53615","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53615","date":"2026-11-07","epss":0.00178,"percentile":0.07365}],"urls":["https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623","https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31","https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af","https://github.com/util-linux/util-linux/releases/tag/v2.41.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53615","description":"util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."}]},{"artifact":{"id":"84c4e558c80e4b90","cpes":["cpe:2.3:a:libarchive:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libarchive-3.3.3-7.el8_10.src.rpm","type":"rpm","version":"3.3.3-7.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5918","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libarchive","version":"0:3.3.3-7.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-5918","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5918","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5918","date":"2026-11-07","epss":0.00393,"percentile":0.33751}],"risk":0.135585,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-5918","description":"A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2025-5918","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":6.6,"impactScore":5.2,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5918","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5918","date":"2026-11-07","epss":0.00393,"percentile":0.33751}],"urls":["https://access.redhat.com/security/cve/CVE-2025-5918","https://bugzilla.redhat.com/show_bug.cgi?id=2370877","https://github.com/libarchive/libarchive/pull/2584","https://github.com/libarchive/libarchive/releases/tag/v3.8.0"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5918","description":"A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition."}]},{"artifact":{"id":"af4525477ddde7ef","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.18.2-34.el8_10:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=rhel-8.10&upstream=krb5-1.18.2-34.el8_10.src.rpm","type":"rpm","version":"1.18.2-34.el8_10","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.18.2-34.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11850","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"krb5","version":"1.18.2-34.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-11850","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-11-07","epss":0.00271,"percentile":0.19412}],"risk":0.1355,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."},"relatedVulnerabilities":[{"id":"CVE-2026-11850","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-11-07","epss":0.00271,"percentile":0.19412}],"urls":["https://access.redhat.com/errata/RHSA-2026:25520","https://access.redhat.com/security/cve/CVE-2026-11850","https://bugzilla.redhat.com/show_bug.cgi?id=2459970"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."}]},{"artifact":{"id":"797a0e1b827791c1","cpes":["cpe:2.3:a:krb5-workstation:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5-workstation:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_workstation:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5_workstation:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_workstation:1.18.2-34.el8_10:*:*:*:*:*:*:*"],"name":"krb5-workstation","purl":"pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=rhel-8.10&upstream=krb5-1.18.2-34.el8_10.src.rpm","type":"rpm","version":"1.18.2-34.el8_10","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.18.2-34.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11850","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"krb5","version":"1.18.2-34.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-11850","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-11-07","epss":0.00271,"percentile":0.19412}],"risk":0.1355,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."},"relatedVulnerabilities":[{"id":"CVE-2026-11850","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-11-07","epss":0.00271,"percentile":0.19412}],"urls":["https://access.redhat.com/errata/RHSA-2026:25520","https://access.redhat.com/security/cve/CVE-2026-11850","https://bugzilla.redhat.com/show_bug.cgi?id=2459970"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."}]},{"artifact":{"id":"4f954c6e0eab6dee","cpes":["cpe:2.3:a:libkadm5:libkadm5:1.18.2-34.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libkadm5:1.18.2-34.el8_10:*:*:*:*:*:*:*"],"name":"libkadm5","purl":"pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=rhel-8.10&upstream=krb5-1.18.2-34.el8_10.src.rpm","type":"rpm","version":"1.18.2-34.el8_10","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5","version":"1.18.2-34.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-11850","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"krb5","version":"1.18.2-34.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-11850","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-11-07","epss":0.00271,"percentile":0.19412}],"risk":0.1355,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."},"relatedVulnerabilities":[{"id":"CVE-2026-11850","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5,"impactScore":4.3,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11850","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-11850","date":"2026-11-07","epss":0.00271,"percentile":0.19412}],"urls":["https://access.redhat.com/errata/RHSA-2026:25520","https://access.redhat.com/security/cve/CVE-2026-11850","https://bugzilla.redhat.com/show_bug.cgi?id=2459970"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data."}]},{"artifact":{"id":"14f406c5bcf8faf4","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.7?arch=x86_64&distro=rhel-8.10&upstream=libxml2-2.9.7-21.el8_10.7.src.rpm","type":"rpm","version":"2.9.7-21.el8_10.7","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0992","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libxml2","version":"0:2.9.7-21.el8_10.7"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-0992","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0992","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0992","date":"2026-11-07","epss":0.00459,"percentile":0.39983}],"risk":0.135405,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-0992","description":"A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition."},"relatedVulnerabilities":[{"id":"CVE-2026-0992","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0992","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0992","date":"2026-11-07","epss":0.00459,"percentile":0.39983}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-0992","https://bugzilla.redhat.com/show_bug.cgi?id=2429975","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0992","description":"A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44621","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-44621","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44621","cwe":"CWE-754","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-44621","date":"2026-11-07","epss":0.00248,"percentile":0.16176}],"risk":0.13516,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44621","description":"A flaw was found in libunbound, a library used by applications for DNS resolution. A remote attacker could exploit this vulnerability by sending specially crafted network traffic. This could cause applications using libunbound to terminate unexpectedly, leading to a denial of service (DoS). This occurs when the 'unwanted-reply-threshold' is configured, and the application attempts to call a cleanup function that is not properly allowed, resulting in a fatal exit."},"relatedVulnerabilities":[{"id":"CVE-2026-44621","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44621","cwe":"CWE-754","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-44621","date":"2026-11-07","epss":0.00248,"percentile":0.16176}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44621.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44621","description":"With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is registed in the allow list and proceeds to perform the documented cache flush."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44621","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-44621","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44621","cwe":"CWE-754","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-44621","date":"2026-11-07","epss":0.00248,"percentile":0.16176}],"risk":0.13516,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-44621","description":"A flaw was found in libunbound, a library used by applications for DNS resolution. A remote attacker could exploit this vulnerability by sending specially crafted network traffic. This could cause applications using libunbound to terminate unexpectedly, leading to a denial of service (DoS). This occurs when the 'unwanted-reply-threshold' is configured, and the application attempts to call a cleanup function that is not properly allowed, resulting in a fatal exit."},"relatedVulnerabilities":[{"id":"CVE-2026-44621","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44621","cwe":"CWE-754","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-44621","date":"2026-11-07","epss":0.00248,"percentile":0.16176}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44621.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44621","description":"With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is registed in the allow list and proceeds to perform the documented cache flush."}]},{"artifact":{"id":"45c8f2a88ad57c26","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.2.20-4.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnupg2:2.2.20-4.el8_10:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=rhel-8.10&upstream=gnupg2-2.2.20-4.el8_10.src.rpm","type":"rpm","version":"2.2.20-4.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gnupg2","version":"0:2.2.20-4.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-07","epss":0.00293,"percentile":0.22021}],"risk":0.13477999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2022-3219","description":"A vulnerability was found in GnuPG. GnuPG can spin on a relatively small input by crafting a public key with thousands of signatures attached and compressed down to a few kilobytes. This issue can potentially cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-07","epss":0.00293,"percentile":0.22021}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-55990","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-55990","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55990","cwe":"CWE-457","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-55990","date":"2026-11-07","epss":0.00247,"percentile":0.16091}],"risk":0.134615,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-55990","description":"A flaw was found in Unbound when configured with DNSCrypt support. An unauthenticated remote attacker could exploit a faulty configuration, where an imbalance between DNSCrypt provider certificate and secret key files leads to memory corruption. By sending a specially crafted network request, the attacker can cause a garbage dereference, leading to a server crash and a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-55990","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55990","cwe":"CWE-457","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-55990","date":"2026-11-07","epss":0.00247,"percentile":0.16091}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55990.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55990","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support ('--enable-dnscrypt')."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-55990","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-55990","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55990","cwe":"CWE-457","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-55990","date":"2026-11-07","epss":0.00247,"percentile":0.16091}],"risk":0.134615,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-55990","description":"A flaw was found in Unbound when configured with DNSCrypt support. An unauthenticated remote attacker could exploit a faulty configuration, where an imbalance between DNSCrypt provider certificate and secret key files leads to memory corruption. By sending a specially crafted network request, the attacker can cause a garbage dereference, leading to a server crash and a denial of service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-55990","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55990","cwe":"CWE-457","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-55990","date":"2026-11-07","epss":0.00247,"percentile":0.16091}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55990.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55990","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support ('--enable-dnscrypt')."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116566","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-07","epss":0.00259,"percentile":0.17723}],"risk":0.133385,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-116566","description":"A flaw was found in Python. An attacker could bypass security controls and redirect network connections to unintended destinations due to improper input handling in the socket.getaddrinfo() function. Specifically, when host or port parameters contain null byte characters, the values are silently truncated during address resolution. This flaw enables attackers who supply network inputs to evade validation filters, such as domain or port allowlists."},"relatedVulnerabilities":[{"id":"CVE-2026-116566","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-07","epss":0.00259,"percentile":0.17723}],"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116566","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-07","epss":0.00259,"percentile":0.17723}],"risk":0.133385,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-116566","description":"A flaw was found in Python. An attacker could bypass security controls and redirect network connections to unintended destinations due to improper input handling in the socket.getaddrinfo() function. Specifically, when host or port parameters contain null byte characters, the values are silently truncated during address resolution. This flaw enables attackers who supply network inputs to evade validation filters, such as domain or port allowlists."},"relatedVulnerabilities":[{"id":"CVE-2026-116566","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-07","epss":0.00259,"percentile":0.17723}],"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}]},{"artifact":{"id":"9596d540aa4016c7","cpes":["cpe:2.3:a:redhat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.5.0-2.el8_10.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/redhat/expat@2.5.0-2.el8_10.2?arch=x86_64&distro=rhel-8.10&upstream=expat-2.5.0-2.el8_10.2.src.rpm","type":"rpm","version":"2.5.0-2.el8_10.2","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-41080","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"expat","version":"0:2.5.0-2.el8_10.2"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-41080","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41080","cwe":"CWE-331","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41080","date":"2026-11-07","epss":0.00398,"percentile":0.34284}],"risk":0.13333,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-41080","description":"A flaw was found in libexpat. A remote attacker could exploit this vulnerability by providing a specially crafted XML document that leverages insufficient entropy in the hash function. This can lead to hash flooding, a type of Denial of Service (DoS) attack, where the system becomes unresponsive or crashes due to excessive resource consumption."},"relatedVulnerabilities":[{"id":"CVE-2026-41080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41080","cwe":"CWE-331","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-41080","date":"2026-11-07","epss":0.00398,"percentile":0.34284}],"urls":["https://blog.hartwork.org/posts/expat-2-8-0-released/","https://github.com/libexpat/libexpat/issues/47","https://github.com/libexpat/libexpat/pull/1183","https://www.openwall.com/lists/oss-security/2026/04/26/1","http://www.openwall.com/lists/oss-security/2026/04/26/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41080","description":"libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document."}]},{"artifact":{"id":"bcecf49dfefd132c","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.26.0-21.el8_10?arch=x86_64&distro=rhel-8.10&upstream=sqlite-3.26.0-21.el8_10.src.rpm","type":"rpm","version":"3.26.0-21.el8_10","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.26.0-21.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119378","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"sqlite","version":"3.26.0-21.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-119378","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-07","epss":0.00251,"percentile":0.16533}],"risk":0.131775,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119378","description":"A flaw was found in SQLite. A use-after-free vulnerability in the R-Tree extension allows an attacker to cause a Denial of Service (DoS) by convincing a user or service to process a specially crafted database. By manipulating internal shadow tables used by the extension, the application improperly accesses previously freed memory during index operations, causing the process to crash."},"relatedVulnerabilities":[{"id":"CVE-2026-119378","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-07","epss":0.00251,"percentile":0.16533}],"urls":["https://abraxaslabs.tech/research/sqlite-rtree-rowid0","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905","https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/6a9e1415659f9e75","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119378","description":"SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."}]},{"artifact":{"id":"5c842fe0f64f5a4c","cpes":["cpe:2.3:a:libssh:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh","purl":"pkg:rpm/redhat/libssh@0.9.6-17.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-8277","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0:0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-8277","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8277","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-8277","date":"2026-11-07","epss":0.00431,"percentile":0.37605}],"risk":0.131455,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-8277","description":"A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability."},"relatedVulnerabilities":[{"id":"CVE-2025-8277","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8277","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-8277","date":"2026-11-07","epss":0.00431,"percentile":0.37605}],"urls":["https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2025-8277","https://bugzilla.redhat.com/show_bug.cgi?id=2383888","https://www.libssh.org/security/advisories/CVE-2025-8277.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8277","description":"A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability."}]},{"artifact":{"id":"bd8c4541a903d30b","cpes":["cpe:2.3:a:libssh-config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh-config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh-config","purl":"pkg:rpm/redhat/libssh-config@0.9.6-17.el8_10?arch=noarch&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libssh","version":"0.9.6-17.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8277","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-8277","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8277","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-8277","date":"2026-11-07","epss":0.00431,"percentile":0.37605}],"risk":0.131455,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-8277","description":"A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability."},"relatedVulnerabilities":[{"id":"CVE-2025-8277","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8277","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-8277","date":"2026-11-07","epss":0.00431,"percentile":0.37605}],"urls":["https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2025-8277","https://bugzilla.redhat.com/show_bug.cgi?id=2383888","https://www.libssh.org/security/advisories/CVE-2025-8277.txt"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8277","description":"A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-50251","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-50251","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50251","cwe":"CWE-184","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-50251","date":"2026-11-07","epss":0.00254,"percentile":0.16984}],"risk":0.13081,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-50251","description":"A flaw was found in Unbound. A remote malicious actor can exploit a vulnerability by controlling a DNS delegation that returns specific glue records. This can cause Unbound to repeatedly clear its DNS caches, leading to a continuous Denial of Service (DoS) for DNS resolution."},"relatedVulnerabilities":[{"id":"CVE-2026-50251","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50251","cwe":"CWE-184","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-50251","date":"2026-11-07","epss":0.00254,"percentile":0.16984}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50251.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50251","description":"In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured 'unwanted-reply-threshold' that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of 'unwanted-reply-threshold' to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound's own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-50251","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-50251","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50251","cwe":"CWE-184","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-50251","date":"2026-11-07","epss":0.00254,"percentile":0.16984}],"risk":0.13081,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-50251","description":"A flaw was found in Unbound. A remote malicious actor can exploit a vulnerability by controlling a DNS delegation that returns specific glue records. This can cause Unbound to repeatedly clear its DNS caches, leading to a continuous Denial of Service (DoS) for DNS resolution."},"relatedVulnerabilities":[{"id":"CVE-2026-50251","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50251","cwe":"CWE-184","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-50251","date":"2026-11-07","epss":0.00254,"percentile":0.16984}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50251.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50251","description":"In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured 'unwanted-reply-threshold' that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of 'unwanted-reply-threshold' to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound's own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-13837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13837","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13837","date":"2026-11-07","epss":0.00239,"percentile":0.15066}],"risk":0.130255,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-13837","description":"A flaw was found in the plistlib module in the Python standard library. The amount of data to read from a Plist file is specified in the file itself. This issue allows a specially crafted Plist file to cause an application to allocate a large amount of memory, potentially resulting in allocations errors, swapping, out-of-memory conditions or even system freezes."},"relatedVulnerabilities":[{"id":"CVE-2025-13837","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13837","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13837","date":"2026-11-07","epss":0.00239,"percentile":0.15066}],"urls":["https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036","https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b","https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70","https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba","https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb","https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111","https://github.com/python/cpython/issues/119342","https://github.com/python/cpython/pull/119343","https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13837","description":"When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues"}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13837","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-13837","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13837","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13837","date":"2026-11-07","epss":0.00239,"percentile":0.15066}],"risk":0.130255,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-13837","description":"A flaw was found in the plistlib module in the Python standard library. The amount of data to read from a Plist file is specified in the file itself. This issue allows a specially crafted Plist file to cause an application to allocate a large amount of memory, potentially resulting in allocations errors, swapping, out-of-memory conditions or even system freezes."},"relatedVulnerabilities":[{"id":"CVE-2025-13837","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13837","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13837","date":"2026-11-07","epss":0.00239,"percentile":0.15066}],"urls":["https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036","https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b","https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70","https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba","https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb","https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111","https://github.com/python/cpython/issues/119342","https://github.com/python/cpython/pull/119343","https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13837","description":"When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues"}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-55717","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-55717","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55717","cwe":"CWE-476","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-55717","date":"2026-11-07","epss":0.00237,"percentile":0.14838}],"risk":0.129165,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-55717","description":"A flaw in Unbound allows a remote attacker controlling a delegated domain to trigger a NULL pointer dereference and crash the daemon. Exploitation occurs when serve-expired: yes and specific response-ip or RPZ rules are configured, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-55717","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55717","cwe":"CWE-476","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-55717","date":"2026-11-07","epss":0.00237,"percentile":0.14838}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55717.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55717","description":"In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of 'serve-expired-client-timeout' is taken leading to denial of service via the server crash."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-55717","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-55717","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55717","cwe":"CWE-476","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-55717","date":"2026-11-07","epss":0.00237,"percentile":0.14838}],"risk":0.129165,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-55717","description":"A flaw in Unbound allows a remote attacker controlling a delegated domain to trigger a NULL pointer dereference and crash the daemon. Exploitation occurs when serve-expired: yes and specific response-ip or RPZ rules are configured, resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-55717","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55717","cwe":"CWE-476","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2026-55717","date":"2026-11-07","epss":0.00237,"percentile":0.14838}],"urls":["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55717.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55717","description":"In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of 'serve-expired-client-timeout' is taken leading to denial of service via the server crash."}]},{"artifact":{"id":"13b38de60a9fc1f5","cpes":["cpe:2.3:a:redhat:wget:1.19.5-16.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:wget:wget:1.19.5-16.el8_10:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:rpm/redhat/wget@1.19.5-16.el8_10?arch=x86_64&distro=rhel-8.10&upstream=wget-1.19.5-16.el8_10.src.rpm","type":"rpm","version":"1.19.5-16.el8_10","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-58470","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"wget","version":"0:1.19.5-16.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-58470","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58470","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58470","date":"2026-11-07","epss":0.00247,"percentile":0.16086}],"risk":0.127205,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-58470","description":"An integer overflow in GNU Wget's parse_content_range() function allows malicious servers to send crafted Content-Range headers. This triggers undefined behavior and download desynchronization, potentially causing a denial of service or data integrity issues for the client."},"relatedVulnerabilities":[{"id":"CVE-2026-58470","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58470","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58470","date":"2026-11-07","epss":0.00247,"percentile":0.16086}],"urls":["https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf","https://www.vulncheck.com/advisories/gnu-wget-integer-overflow-via-content-range-header-parsing"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58470","description":"GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client."}]},{"artifact":{"id":"5c842fe0f64f5a4c","cpes":["cpe:2.3:a:libssh:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh","purl":"pkg:rpm/redhat/libssh@0.9.6-17.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-8114","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0:0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-8114","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8114","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-8114","date":"2026-11-07","epss":0.00259,"percentile":0.17672}],"risk":0.125615,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-8114","description":"A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash."},"relatedVulnerabilities":[{"id":"CVE-2025-8114","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8114","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-8114","date":"2026-11-07","epss":0.00259,"percentile":0.17672}],"urls":["https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2025-8114","https://bugzilla.redhat.com/show_bug.cgi?id=2383220","https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb2c5463f6c4cd1525331bd578812d","https://git.libssh.org/projects/libssh.git/commit/?id=65f363c9","https://www.libssh.org/security/advisories/CVE-2025-8114.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8114","description":"A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash."}]},{"artifact":{"id":"bd8c4541a903d30b","cpes":["cpe:2.3:a:libssh-config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh-config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh_config:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:libssh:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh-config:0.9.6-17.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libssh_config:0.9.6-17.el8_10:*:*:*:*:*:*:*"],"name":"libssh-config","purl":"pkg:rpm/redhat/libssh-config@0.9.6-17.el8_10?arch=noarch&distro=rhel-8.10&upstream=libssh-0.9.6-17.el8_10.src.rpm","type":"rpm","version":"0.9.6-17.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libssh","version":"0.9.6-17.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8114","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libssh","version":"0.9.6-17.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-8114","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8114","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-8114","date":"2026-11-07","epss":0.00259,"percentile":0.17672}],"risk":0.125615,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-8114","description":"A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash."},"relatedVulnerabilities":[{"id":"CVE-2025-8114","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8114","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-8114","date":"2026-11-07","epss":0.00259,"percentile":0.17672}],"urls":["https://access.redhat.com/errata/RHSA-2026:18683","https://access.redhat.com/security/cve/CVE-2025-8114","https://bugzilla.redhat.com/show_bug.cgi?id=2383220","https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb2c5463f6c4cd1525331bd578812d","https://git.libssh.org/projects/libssh.git/commit/?id=65f363c9","https://www.libssh.org/security/advisories/CVE-2025-8114.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8114","description":"A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash."}]},{"artifact":{"id":"3daf927dec9eda42","cpes":["cpe:2.3:a:gnutls:gnutls:3.6.16-8.el8_10.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:gnutls:3.6.16-8.el8_10.6:*:*:*:*:*:*:*"],"name":"gnutls","purl":"pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=rhel-8.10&upstream=gnutls-3.6.16-8.el8_10.6.src.rpm","type":"rpm","version":"3.6.16-8.el8_10.6","language":"","licenses":["GPLv3+ and LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88648","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"gnutls","version":"0:3.6.16-8.el8_10.6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-88648","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88648","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88648","date":"2026-11-07","epss":0.00202,"percentile":0.1026}],"risk":0.12524000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-88648","description":"A flaw was found in GnuTLS. An attacker controlling a subordinate Certificate Authority (CA) can exploit an incomplete X.509 certificate validation mechanism to bypass cross-domain Public Key Infrastructure (PKI) restrictions. This allows unauthorized certificates to be accepted as valid, potentially enabling the attacker to impersonate trusted domains and intercept secure communications."},"relatedVulnerabilities":[{"id":"CVE-2026-88648","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88648","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88648","date":"2026-11-07","epss":0.00202,"percentile":0.1026}],"urls":["https://gist.github.com/lkloliver/1f2a97cb8d0b31aa27b6bd0354358d7d","https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md","https://gitlab.com/gnutls/gnutls/-/work_items/1965","https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10","https://www.rfc-editor.org/rfc/rfc5280#section-6.1.4","https://github.com/lkloliver/poc/tree/main/CVE-2026-88648"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88648","description":"In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6019","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-6019","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6019","cwe":"CWE-150","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6019","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6019","date":"2026-11-07","epss":0.00211,"percentile":0.11347}],"risk":0.12448999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6019","description":"A flaw was found in Python's `http.cookies` module. The `Morsel.js_output()` function, responsible for generating JavaScript output for cookies, does not properly neutralize the `</script>` HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to Cross-Site Scripting (XSS) attacks. Such an attack could result in information disclosure or arbitrary code execution within the user's browser."},"relatedVulnerabilities":[{"id":"CVE-2026-6019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6019","cwe":"CWE-150","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6019","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6019","date":"2026-11-07","epss":0.00211,"percentile":0.11347}],"urls":["https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c","https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104","https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8","https://github.com/python/cpython/issues/90309","https://github.com/python/cpython/pull/148848","https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6019","description":"http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6019","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-6019","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6019","cwe":"CWE-150","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6019","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6019","date":"2026-11-07","epss":0.00211,"percentile":0.11347}],"risk":0.12448999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6019","description":"A flaw was found in Python's `http.cookies` module. The `Morsel.js_output()` function, responsible for generating JavaScript output for cookies, does not properly neutralize the `</script>` HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to Cross-Site Scripting (XSS) attacks. Such an attack could result in information disclosure or arbitrary code execution within the user's browser."},"relatedVulnerabilities":[{"id":"CVE-2026-6019","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6019","cwe":"CWE-150","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-6019","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6019","date":"2026-11-07","epss":0.00211,"percentile":0.11347}],"urls":["https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c","https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104","https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8","https://github.com/python/cpython/issues/90309","https://github.com/python/cpython/pull/148848","https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6019","description":"http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes \" for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-11-07","epss":0.00371,"percentile":0.31278}],"risk":0.12428499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80230","description":"A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection."},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-11-07","epss":0.00371,"percentile":0.31278}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80230","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-11-07","epss":0.00371,"percentile":0.31278}],"risk":0.12428499999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-80230","description":"A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection."},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-11-07","epss":0.00371,"percentile":0.31278}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"bcecf49dfefd132c","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.26.0-21.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.26.0-21.el8_10:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:rpm/redhat/sqlite-libs@3.26.0-21.el8_10?arch=x86_64&distro=rhel-8.10&upstream=sqlite-3.26.0-21.el8_10.src.rpm","type":"rpm","version":"3.26.0-21.el8_10","language":"","licenses":["Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite","version":"3.26.0-21.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119373","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"sqlite","version":"3.26.0-21.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-119373","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-07","epss":0.00162,"percentile":0.05447}],"risk":0.12393,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-119373","description":"A flaw was found in SQLite. A heap-based buffer overflow exists in the Full-Text Search 5 (FTS5) extension during the merging of prefix document lists. An attacker capable of inserting negative row identifiers into a configured table and executing a prefix search query can cause data to be written beyond allocated memory. This issue can lead to memory corruption, resulting in application crashes, a Denial of Service (DoS), or potentially arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-119373","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-07","epss":0.00162,"percentile":0.05447}],"urls":["https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107","https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80","https://sqlite.org/bugs/info/2026-08-04T08:49:27Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/a7f8c92f62","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119373","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-43168","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-43168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":3.4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43168","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2024-43168","date":"2026-11-07","epss":0.00314,"percentile":0.24467}],"risk":0.12246,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-43168","description":"A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system."},"relatedVulnerabilities":[{"id":"CVE-2024-43168","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":3.4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43168","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2024-43168","date":"2026-11-07","epss":0.00314,"percentile":0.24467}],"urls":["https://access.redhat.com/security/cve/CVE-2024-43168","https://bugzilla.redhat.com/show_bug.cgi?id=2303462","https://github.com/NLnetLabs/unbound/issues/1039","https://github.com/NLnetLabs/unbound/pull/1040/files","https://lists.debian.org/debian-lts-announce/2024/09/msg00046.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43168","description":"DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-43168","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-43168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":3.4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43168","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2024-43168","date":"2026-11-07","epss":0.00314,"percentile":0.24467}],"risk":0.12246,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-43168","description":"A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system."},"relatedVulnerabilities":[{"id":"CVE-2024-43168","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":3.4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43168","cwe":"CWE-122","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2024-43168","date":"2026-11-07","epss":0.00314,"percentile":0.24467}],"urls":["https://access.redhat.com/security/cve/CVE-2024-43168","https://bugzilla.redhat.com/show_bug.cgi?id=2303462","https://github.com/NLnetLabs/unbound/issues/1039","https://github.com/NLnetLabs/unbound/pull/1040/files","https://lists.debian.org/debian-lts-announce/2024/09/msg00046.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43168","description":"DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system."}]},{"artifact":{"id":"14f406c5bcf8faf4","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.7?arch=x86_64&distro=rhel-8.10&upstream=libxml2-2.9.7-21.el8_10.7.src.rpm","type":"rpm","version":"2.9.7-21.el8_10.7","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-1757","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libxml2","version":"0:2.9.7-21.el8_10.7"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-1757","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1757","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1757","date":"2026-11-07","epss":0.00217,"percentile":0.1228}],"risk":0.12152,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system."},"relatedVulnerabilities":[{"id":"CVE-2026-1757","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1757","cwe":"CWE-401","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1757","date":"2026-11-07","epss":0.00217,"percentile":0.1228}],"urls":["https://access.redhat.com/errata/RHSA-2026:7519","https://access.redhat.com/security/cve/CVE-2026-1757","https://bugzilla.redhat.com/show_bug.cgi?id=2435940","https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system."}]},{"artifact":{"id":"21df7f4e995c68e8","cpes":["cpe:2.3:a:diffutils:diffutils:3.6-6.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:diffutils:3.6-6.el8:*:*:*:*:*:*:*"],"name":"diffutils","purl":"pkg:rpm/redhat/diffutils@3.6-6.el8?arch=x86_64&distro=rhel-8.10&upstream=diffutils-3.6-6.el8.src.rpm","type":"rpm","version":"3.6-6.el8","language":"","licenses":["GPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53910","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"diffutils","version":"0:3.6-6.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53910","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53910","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-53910","date":"2026-11-07","epss":0.00291,"percentile":0.21851}],"risk":0.120765,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53910","description":"A flaw was found in the diff3 program in the diffutils package. When processing specially crafted diff output, a heap-based buffer overflow can occur due to multiple signed integer overflows in line-mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds, resulting in a denial of service or memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-53910","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53910","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-53910","date":"2026-11-07","epss":0.00291,"percentile":0.21851}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-53910","https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50","https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815","https://git.savannah.gnu.org/cgit/diffutils.git/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53910","description":"diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds.\nWhen processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing. \nAn attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.\n\n\nThis issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815 \n\nNOTE:\nThe project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges."}]},{"artifact":{"id":"7099e1b9cc673e8a","cpes":["cpe:2.3:a:redhat:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.28-251.el8_10.43"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"< 0:2.28-251.el8_10.43 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"0:2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"fixed","versions":["0:2.28-251.el8_10.43"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"0:2.28-251.el8_10.43"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-11-07","epss":0.0022,"percentile":0.12526}],"risk":0.11990000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:76777","link":"https://access.redhat.com/errata/RHSA-2026:76777"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6791","description":"A flaw was found in glibc. When processing paths that start with a tilde (~) followed by a username, the `wordexp` function can be forced to allocate an excessive amount of memory on the program's stack. A remote attacker could exploit this by providing a very long username, leading to a stack exhaustion and causing a denial of service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-11-07","epss":0.0022,"percentile":0.12526}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"f9f2f96854016567","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.28-251.el8_10.43"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"< 0:2.28-251.el8_10.43 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"fixed","versions":["0:2.28-251.el8_10.43"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"0:2.28-251.el8_10.43"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-11-07","epss":0.0022,"percentile":0.12526}],"risk":0.11990000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:76777","link":"https://access.redhat.com/errata/RHSA-2026:76777"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6791","description":"A flaw was found in glibc. When processing paths that start with a tilde (~) followed by a username, the `wordexp` function can be forced to allocate an excessive amount of memory on the program's stack. A remote attacker could exploit this by providing a very long username, leading to a stack exhaustion and causing a denial of service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-11-07","epss":0.0022,"percentile":0.12526}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"44a10f7911e45aa5","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.28-251.el8_10.43"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"< 0:2.28-251.el8_10.43 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"fixed","versions":["0:2.28-251.el8_10.43"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"0:2.28-251.el8_10.43"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-11-07","epss":0.0022,"percentile":0.12526}],"risk":0.11990000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:76777","link":"https://access.redhat.com/errata/RHSA-2026:76777"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-6791","description":"A flaw was found in glibc. When processing paths that start with a tilde (~) followed by a username, the `wordexp` function can be forced to allocate an excessive amount of memory on the program's stack. A remote attacker could exploit this by providing a very long username, leading to a stack exhaustion and causing a denial of service (DoS) for the affected application."},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-11-07","epss":0.0022,"percentile":0.12526}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"f3dbf2601d631118","cpes":["cpe:2.3:a:python3-rpm:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.14.3-32.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-07","epss":0.00199,"percentile":0.09727}],"risk":0.11939999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-07","epss":0.00199,"percentile":0.09727}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"6c723629f01508b1","cpes":["cpe:2.3:a:redhat:rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"0:4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-07","epss":0.00199,"percentile":0.09727}],"risk":0.11939999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-07","epss":0.00199,"percentile":0.09727}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"e44a5dd2f875a462","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.14.3-32.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-07","epss":0.00199,"percentile":0.09727}],"risk":0.11939999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-07","epss":0.00199,"percentile":0.09727}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"9c24e9e6f2be9987","cpes":["cpe:2.3:a:rpm-libs:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.14.3-32.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.14.3-32.el8_10:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=rhel-8.10&upstream=rpm-4.14.3-32.el8_10.src.rpm","type":"rpm","version":"4.14.3-32.el8_10","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.14.3-32.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78367","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"rpm","version":"4.14.3-32.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-78367","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-07","epss":0.00199,"percentile":0.09727}],"risk":0.11939999999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-11-07","epss":0.00199,"percentile":0.09727}],"urls":["https://access.redhat.com/errata/RHSA-2026:82378","https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."}]},{"artifact":{"id":"796569fea39cc9f9","cpes":["cpe:2.3:a:libblkid:libblkid:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libblkid:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"libblkid","purl":"pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.32.1-48.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"risk":0.11817499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory - for example by using renameat2(RENAME_EXCHANGE) - to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"9c525777ab67163b","cpes":["cpe:2.3:a:libfdisk:libfdisk:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libfdisk:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"libfdisk","purl":"pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.32.1-48.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"risk":0.11817499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory - for example by using renameat2(RENAME_EXCHANGE) - to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"cd8c90c0af5b2eb1","cpes":["cpe:2.3:a:libmount:libmount:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libmount:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"libmount","purl":"pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.32.1-48.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"risk":0.11817499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory - for example by using renameat2(RENAME_EXCHANGE) - to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"11f35d4d876e70d8","cpes":["cpe:2.3:a:libsmartcols:libsmartcols:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libsmartcols:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"libsmartcols","purl":"pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.32.1-48.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"risk":0.11817499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory - for example by using renameat2(RENAME_EXCHANGE) - to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"b4549ca66835b489","cpes":["cpe:2.3:a:libuuid:libuuid:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libuuid:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"libuuid","purl":"pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux","version":"2.32.1-48.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"risk":0.11817499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory - for example by using renameat2(RENAME_EXCHANGE) - to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"bd8a0a396c843f50","cpes":["cpe:2.3:a:util-linux:util-linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util-linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:util_linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.32.1-48.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.32.1-48.el8_10:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=rhel-8.10&upstream=util-linux-2.32.1-48.el8_10.src.rpm","type":"rpm","version":"2.32.1-48.el8_10","language":"","licenses":["GPLv2 and GPLv2+ and LGPLv2+ and BSD with advertising and Public Domain"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53613","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"util-linux","version":"0:2.32.1-48.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-53613","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"risk":0.11817499999999999,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-53613","description":"When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory - for example by using renameat2(RENAME_EXCHANGE) - to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root."},"relatedVulnerabilities":[{"id":"CVE-2026-53613","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53613","cwe":"CWE-367","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-53613","date":"2026-11-07","epss":0.00163,"percentile":0.05541}],"urls":["https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2","https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0","https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8","https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4","https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec","https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9","https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78","https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5","https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9","https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2","https://github.com/util-linux/util-linux/releases/tag/v2.41.5","https://github.com/util-linux/util-linux/releases/tag/v2.42.2","https://github.com/util-linux/util-linux/releases/tag/v2.42.4","https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53613","description":"util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."}]},{"artifact":{"id":"14f406c5bcf8faf4","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.7?arch=x86_64&distro=rhel-8.10&upstream=libxml2-2.9.7-21.el8_10.7.src.rpm","type":"rpm","version":"2.9.7-21.el8_10.7","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.9.7-21.el8_10.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86140","versionConstraint":"< 0:2.9.7-21.el8_10.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libxml2","version":"0:2.9.7-21.el8_10.7"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-86140","fix":{"state":"fixed","versions":["0:2.9.7-21.el8_10.9"],"available":[{"date":"2026-09-25","kind":"first-observed","version":"0:2.9.7-21.el8_10.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86140","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86140","date":"2026-11-07","epss":0.00157,"percentile":0.04917}],"risk":0.116965,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:71641","link":"https://access.redhat.com/errata/RHSA-2026:71641"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86140","description":"A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited."},"relatedVulnerabilities":[{"id":"CVE-2026-86140","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86140","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86140","date":"2026-11-07","epss":0.00157,"percentile":0.04917}],"urls":["https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86140","description":"In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow."}]},{"artifact":{"id":"14f406c5bcf8faf4","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libxml2:2.9.7-21.el8_10.7:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.7?arch=x86_64&distro=rhel-8.10&upstream=libxml2-2.9.7-21.el8_10.7.src.rpm","type":"rpm","version":"2.9.7-21.el8_10.7","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.9.7-21.el8_10.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86143","versionConstraint":"< 0:2.9.7-21.el8_10.9 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libxml2","version":"0:2.9.7-21.el8_10.7"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-86143","fix":{"state":"fixed","versions":["0:2.9.7-21.el8_10.9"],"available":[{"date":"2026-09-25","kind":"first-observed","version":"0:2.9.7-21.el8_10.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86143","cwe":"CWE-192","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86143","date":"2026-11-07","epss":0.00194,"percentile":0.09097}],"risk":0.11543,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:71641","link":"https://access.redhat.com/errata/RHSA-2026:71641"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-86143","description":"An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity."},"relatedVulnerabilities":[{"id":"CVE-2026-86143","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86143","cwe":"CWE-192","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86143","date":"2026-11-07","epss":0.00194,"percentile":0.09097}],"urls":["https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4","https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86143","description":"In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback."}]},{"artifact":{"id":"70e1c820b84e6e1c","cpes":["cpe:2.3:a:python3-unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_unbound:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_unbound:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"python3-unbound","purl":"pkg:rpm/redhat/python3-unbound@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-43167","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-43167","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43167","cwe":"CWE-476","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2024-43167","date":"2026-11-07","epss":0.00394,"percentile":0.33792}],"risk":0.11425999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-43167","description":"A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly."},"relatedVulnerabilities":[{"id":"CVE-2024-43167","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43167","cwe":"CWE-476","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2024-43167","date":"2026-11-07","epss":0.00394,"percentile":0.33792}],"urls":["https://access.redhat.com/security/cve/CVE-2024-43167","https://bugzilla.redhat.com/show_bug.cgi?id=2303456","https://github.com/NLnetLabs/unbound/issues/1072","https://github.com/NLnetLabs/unbound/pull/1073/files","http://www.openwall.com/lists/oss-security/2024/08/16/6","https://lists.debian.org/debian-lts-announce/2024/09/msg00046.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43167","description":"DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly."}]},{"artifact":{"id":"13340578b057e37b","cpes":["cpe:2.3:a:unbound-libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound-libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound_libs:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:unbound:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound-libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:unbound_libs:1.16.2-5.14.el8_10:*:*:*:*:*:*:*"],"name":"unbound-libs","purl":"pkg:rpm/redhat/unbound-libs@1.16.2-5.14.el8_10?arch=x86_64&distro=rhel-8.10&upstream=unbound-1.16.2-5.14.el8_10.src.rpm","type":"rpm","version":"1.16.2-5.14.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"unbound","version":"1.16.2-5.14.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-43167","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"unbound","version":"1.16.2-5.14.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-43167","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43167","cwe":"CWE-476","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2024-43167","date":"2026-11-07","epss":0.00394,"percentile":0.33792}],"risk":0.11425999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-43167","description":"A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly."},"relatedVulnerabilities":[{"id":"CVE-2024-43167","cvss":[{"type":"Secondary","source":"sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43167","cwe":"CWE-476","type":"Secondary","source":"sep@nlnetlabs.nl"}],"epss":[{"cve":"CVE-2024-43167","date":"2026-11-07","epss":0.00394,"percentile":0.33792}],"urls":["https://access.redhat.com/security/cve/CVE-2024-43167","https://bugzilla.redhat.com/show_bug.cgi?id=2303456","https://github.com/NLnetLabs/unbound/issues/1072","https://github.com/NLnetLabs/unbound/pull/1073/files","http://www.openwall.com/lists/oss-security/2024/08/16/6","https://lists.debian.org/debian-lts-announce/2024/09/msg00046.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43167","description":"DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly."}]},{"artifact":{"id":"6278a3b6c24fdd42","cpes":["cpe:2.3:a:redhat:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"0:7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-11-07","epss":0.00373,"percentile":0.31494}],"risk":0.11376499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82209","description":"A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a `Set-Cookie` header with a `Domain` attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope, leading to the cookie being inappropriately sent to arbitrary sibling subdomains under the same public suffix. This could result in sensitive information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-11-07","epss":0.00373,"percentile":0.31494}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"e52abe0cc782d201","cpes":["cpe:2.3:a:libcurl:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libcurl:7.61.1-34.el8_10.13:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64&distro=rhel-8.10&upstream=curl-7.61.1-34.el8_10.13.src.rpm","type":"rpm","version":"7.61.1-34.el8_10.13","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"7.61.1-34.el8_10.13"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82209","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"curl","version":"7.61.1-34.el8_10.13"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-11-07","epss":0.00373,"percentile":0.31494}],"risk":0.11376499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-82209","description":"A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a `Set-Cookie` header with a `Domain` attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope, leading to the cookie being inappropriately sent to arbitrary sibling subdomains under the same public suffix. This could result in sensitive information disclosure."},"relatedVulnerabilities":[{"id":"CVE-2026-82209","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-11-07","epss":0.00373,"percentile":0.31494}],"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."}]},{"artifact":{"id":"ce49b1d86fbcf30e","cpes":["cpe:2.3:a:platform-python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform-python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform_python:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:platform:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform-python:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:platform_python:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"platform-python","purl":"pkg:rpm/redhat/platform-python@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4516","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-4516","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4516","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4516","date":"2026-11-07","epss":0.00225,"percentile":0.133}],"risk":0.11362499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-4516","description":"A vulnerability has been identified in CPython's bytes.decode() function when used with the \"unicode_escape\" encoding and the \"ignore\" or \"replace\" error handling modes. This flaw can result in the incorrect decoding of byte strings. While this may not directly lead to traditional security breaches like data exfiltration, the resulting unexpected program behavior could introduce instability, logic errors, or unintended side effects within applications that rely on this specific decoding functionality."},"relatedVulnerabilities":[{"id":"CVE-2025-4516","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4516","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4516","date":"2026-11-07","epss":0.00225,"percentile":0.133}],"urls":["https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292","https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d","https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142","https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f","https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77","https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e","https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b","https://github.com/python/cpython/issues/133767","https://github.com/python/cpython/pull/129648","https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/","http://www.openwall.com/lists/oss-security/2025/05/16/4","http://www.openwall.com/lists/oss-security/2025/05/19/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4516","description":"There is an issue in CPython when using `bytes.decode(\"unicode_escape\", error=\"ignore|replace\")`. If you are not using the \"unicode_escape\" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError."}]},{"artifact":{"id":"42e9d24974fdcae7","cpes":["cpe:2.3:a:python3-libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3-libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3_libs:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3-libs:3.6.8-78.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:python3_libs:3.6.8-78.el8_10:*:*:*:*:*:*:*"],"name":"python3-libs","purl":"pkg:rpm/redhat/python3-libs@3.6.8-78.el8_10?arch=x86_64&distro=rhel-8.10&upstream=python3-3.6.8-78.el8_10.src.rpm","type":"rpm","version":"3.6.8-78.el8_10","language":"","licenses":["Python"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3","version":"3.6.8-78.el8_10"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4516","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"python3","version":"3.6.8-78.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-4516","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4516","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4516","date":"2026-11-07","epss":0.00225,"percentile":0.133}],"risk":0.11362499999999999,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-4516","description":"A vulnerability has been identified in CPython's bytes.decode() function when used with the \"unicode_escape\" encoding and the \"ignore\" or \"replace\" error handling modes. This flaw can result in the incorrect decoding of byte strings. While this may not directly lead to traditional security breaches like data exfiltration, the resulting unexpected program behavior could introduce instability, logic errors, or unintended side effects within applications that rely on this specific decoding functionality."},"relatedVulnerabilities":[{"id":"CVE-2025-4516","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4516","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-4516","date":"2026-11-07","epss":0.00225,"percentile":0.133}],"urls":["https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292","https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d","https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142","https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f","https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77","https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e","https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b","https://github.com/python/cpython/issues/133767","https://github.com/python/cpython/pull/129648","https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/","http://www.openwall.com/lists/oss-security/2025/05/16/4","http://www.openwall.com/lists/oss-security/2025/05/19/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4516","description":"There is an issue in CPython when using `bytes.decode(\"unicode_escape\", error=\"ignore|replace\")`. If you are not using the \"unicode_escape\" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError."}]},{"artifact":{"id":"2740ea74c614de4e","cpes":["cpe:2.3:a:libevent:libevent:2.1.8-5.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libevent:2.1.8-5.el8:*:*:*:*:*:*:*"],"name":"libevent","purl":"pkg:rpm/redhat/libevent@2.1.8-5.el8?arch=x86_64&distro=rhel-8.10&upstream=libevent-2.1.8-5.el8.src.rpm","type":"rpm","version":"2.1.8-5.el8","language":"","licenses":["BSD and ISC"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.1.8-11.el8_10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63388","versionConstraint":"< 0:2.1.8-11.el8_10 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libevent","version":"0:2.1.8-5.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-63388","fix":{"state":"fixed","versions":["0:2.1.8-11.el8_10"],"available":[{"date":"2026-09-17","kind":"first-observed","version":"0:2.1.8-11.el8_10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63388","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63388","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63388","date":"2026-11-07","epss":0.00142,"percentile":0.03511}],"risk":0.11289000000000002,"urls":[],"severity":"High","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:67908","link":"https://access.redhat.com/errata/RHSA-2026:67908"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-63388","description":"A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the `bufferevent_socket_set_conn_address_` function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AF_UNIX listener, an attacker can overwrite critical heap data, leading to memory corruption and potentially full control over the affected system. This can severely impact the confidentiality, integrity, and availability of data and services."},"relatedVulnerabilities":[{"id":"CVE-2026-63388","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63388","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63388","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63388","date":"2026-11-07","epss":0.00142,"percentile":0.03511}],"urls":["https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9","https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63388","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"84c4e558c80e4b90","cpes":["cpe:2.3:a:libarchive:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libarchive-3.3.3-7.el8_10.src.rpm","type":"rpm","version":"3.3.3-7.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-57970","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libarchive","version":"0:3.3.3-7.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-57970","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57970","cwe":"CWE-126","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-57970","date":"2026-11-07","epss":0.0025,"percentile":0.16479}],"risk":0.11250000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-57970","description":"A flaw was found in the libarchive library. A specially-crafted tar file may trigger a head-based buffer over-read condition due to incorrect handling of truncation in the middle of a long GNU linkname. This issue can cause an application crash leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2024-57970","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-57970","cwe":"CWE-126","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-57970","date":"2026-11-07","epss":0.0025,"percentile":0.16479}],"urls":["https://github.com/libarchive/libarchive/issues/2415","https://github.com/libarchive/libarchive/pull/2422"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-57970","description":"libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-31789","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-31789","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-11-07","epss":0.00253,"percentile":0.16862}],"risk":0.11132,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-31789","description":"A flaw was found in OpenSSL. This vulnerability, a heap buffer overflow, affects 32-bit systems when processing an unusually large X.509 certificate. If an application or service attempts to print or log such a specially crafted certificate, it could lead to a system crash or potentially allow an attacker to execute arbitrary code. This issue is considered low severity due to the specific conditions required for exploitation, including the need for an extremely large certificate and a 32-bit operating environment."},"relatedVulnerabilities":[{"id":"CVE-2026-31789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-11-07","epss":0.00253,"percentile":0.16862}],"urls":["https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde","https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf","https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49","https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9","https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","description":"Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-31789","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-31789","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-11-07","epss":0.00253,"percentile":0.16862}],"risk":0.11132,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-31789","description":"A flaw was found in OpenSSL. This vulnerability, a heap buffer overflow, affects 32-bit systems when processing an unusually large X.509 certificate. If an application or service attempts to print or log such a specially crafted certificate, it could lead to a system crash or potentially allow an attacker to execute arbitrary code. This issue is considered low severity due to the specific conditions required for exploitation, including the need for an extremely large certificate and a 32-bit operating environment."},"relatedVulnerabilities":[{"id":"CVE-2026-31789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"impactScore":4.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-31789","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-31789","date":"2026-11-07","epss":0.00253,"percentile":0.16862}],"urls":["https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde","https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf","https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49","https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9","https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","description":"Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"7099e1b9cc673e8a","cpes":["cpe:2.3:a:redhat:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"0:2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-11-07","epss":0.0024,"percentile":0.15181}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89092","description":"A flaw was found in glibc, specifically within the nscd service. A remote attacker, operating a malicious Domain Name System (DNS) server, could send an overly large DNS response. This could trigger a stack overflow in the nscd service, causing it to crash and leading to degraded DNS resolution for the system. There is also a remote possibility of nscd cache corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-11-07","epss":0.0024,"percentile":0.15181}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"f9f2f96854016567","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-11-07","epss":0.0024,"percentile":0.15181}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89092","description":"A flaw was found in glibc, specifically within the nscd service. A remote attacker, operating a malicious Domain Name System (DNS) server, could send an overly large DNS response. This could trigger a stack overflow in the nscd service, causing it to crash and leading to degraded DNS resolution for the system. There is also a remote possibility of nscd cache corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-11-07","epss":0.0024,"percentile":0.15181}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"44a10f7911e45aa5","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-11-07","epss":0.0024,"percentile":0.15181}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-89092","description":"A flaw was found in glibc, specifically within the nscd service. A remote attacker, operating a malicious Domain Name System (DNS) server, could send an overly large DNS response. This could trigger a stack overflow in the nscd service, causing it to crash and leading to degraded DNS resolution for the system. There is also a remote possibility of nscd cache corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-11-07","epss":0.0024,"percentile":0.15181}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"7099e1b9cc673e8a","cpes":["cpe:2.3:a:redhat:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4438","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"0:2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4438","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4438","cwe":"CWE-20","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-4438","cwe":"CWE-88","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4438","date":"2026-11-07","epss":0.00314,"percentile":0.24522}],"risk":0.1099,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4438","description":"A flaw was found in the GNU C library (glibc). When applications use the `gethostbyaddr` or `gethostbyaddr_r` functions with a `nsswitch.conf` configuration that specifies glibc's DNS backend, the library may return an invalid DNS hostname. This violates the DNS specification and could lead to applications receiving incorrect hostname information, potentially impacting network operations or security decisions."},"relatedVulnerabilities":[{"id":"CVE-2026-4438","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4438","cwe":"CWE-20","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-4438","cwe":"CWE-88","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4438","date":"2026-11-07","epss":0.00314,"percentile":0.24522}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34015","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4438","description":"Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification."}]},{"artifact":{"id":"f9f2f96854016567","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4438","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4438","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4438","cwe":"CWE-20","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-4438","cwe":"CWE-88","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4438","date":"2026-11-07","epss":0.00314,"percentile":0.24522}],"risk":0.1099,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4438","description":"A flaw was found in the GNU C library (glibc). When applications use the `gethostbyaddr` or `gethostbyaddr_r` functions with a `nsswitch.conf` configuration that specifies glibc's DNS backend, the library may return an invalid DNS hostname. This violates the DNS specification and could lead to applications receiving incorrect hostname information, potentially impacting network operations or security decisions."},"relatedVulnerabilities":[{"id":"CVE-2026-4438","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4438","cwe":"CWE-20","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-4438","cwe":"CWE-88","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4438","date":"2026-11-07","epss":0.00314,"percentile":0.24522}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34015","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4438","description":"Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification."}]},{"artifact":{"id":"44a10f7911e45aa5","cpes":["cpe:2.3:a:glibc-minimal-langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal-langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal_langpack:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_minimal:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-minimal-langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_minimal_langpack:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-minimal-langpack","purl":"pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4438","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-4438","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4438","cwe":"CWE-20","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-4438","cwe":"CWE-88","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4438","date":"2026-11-07","epss":0.00314,"percentile":0.24522}],"risk":0.1099,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-4438","description":"A flaw was found in the GNU C library (glibc). When applications use the `gethostbyaddr` or `gethostbyaddr_r` functions with a `nsswitch.conf` configuration that specifies glibc's DNS backend, the library may return an invalid DNS hostname. This violates the DNS specification and could lead to applications receiving incorrect hostname information, potentially impacting network operations or security decisions."},"relatedVulnerabilities":[{"id":"CVE-2026-4438","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4438","cwe":"CWE-20","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-4438","cwe":"CWE-88","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4438","date":"2026-11-07","epss":0.00314,"percentile":0.24522}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34015","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4438","description":"Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification."}]},{"artifact":{"id":"84c4e558c80e4b90","cpes":["cpe:2.3:a:libarchive:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libarchive-3.3.3-7.el8_10.src.rpm","type":"rpm","version":"3.3.3-7.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-60753","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libarchive","version":"0:3.3.3-7.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-60753","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60753","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-60753","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60753","date":"2026-11-07","epss":0.00206,"percentile":0.10754}],"risk":0.10815000000000002,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-60753","description":"A vulnerability in apply_substitution() function in libarchive's bsdtar allows crafted -s substitution rules to repeatedly match a zero-length substring and append replacements without advancing the input pointer. When the rule uses the global /g flag (or an explicitly empty pattern), this leads to unbounded output allocation and eventual process OOM (Denial of Service). Upgrade to libarchive 3.8.1 or apply a patch that prevents zero-length match loops or rejects empty patterns."},"relatedVulnerabilities":[{"id":"CVE-2025-60753","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60753","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-60753","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60753","date":"2026-11-07","epss":0.00206,"percentile":0.10754}],"urls":["https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753","https://github.com/libarchive/libarchive/issues/2725"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60753","description":"An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash)."}]},{"artifact":{"id":"84c4e558c80e4b90","cpes":["cpe:2.3:a:libarchive:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libarchive:3.3.3-7.el8_10:*:*:*:*:*:*:*"],"name":"libarchive","purl":"pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=rhel-8.10&upstream=libarchive-3.3.3-7.el8_10.src.rpm","type":"rpm","version":"3.3.3-7.el8_10","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-1632","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libarchive","version":"0:3.3.3-7.el8_10"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2025-1632","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1632","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1632","date":"2026-11-07","epss":0.00342,"percentile":0.2792}],"risk":0.10772999999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2025-1632","description":"A flaw was found in the bsdunzip utility of libarchive. In affected versions, a specially crafted file may trigger a null pointer dereference. This issue can lead to an application crash or other unexpected behavior. This bug does not compromise the integrity or availability of the base system."},"relatedVulnerabilities":[{"id":"CVE-2025-1632","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1632","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1632","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1632","date":"2026-11-07","epss":0.00342,"percentile":0.2792}],"urls":["https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc","https://vuldb.com/?ctiid.296619","https://vuldb.com/?id.296619","https://vuldb.com/?submit.496460"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1632","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}]},{"artifact":{"id":"a5da165c9cb26b12","cpes":["cpe:2.3:a:elfutils-debuginfod-client:elfutils-debuginfod-client:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-debuginfod-client:elfutils_debuginfod_client:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_debuginfod_client:elfutils-debuginfod-client:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_debuginfod_client:elfutils_debuginfod_client:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-debuginfod:elfutils-debuginfod-client:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-debuginfod:elfutils_debuginfod_client:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_debuginfod:elfutils-debuginfod-client:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_debuginfod:elfutils_debuginfod_client:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-debuginfod-client:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_debuginfod_client:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-debuginfod-client:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_debuginfod_client:0.190-2.el8:*:*:*:*:*:*:*"],"name":"elfutils-debuginfod-client","purl":"pkg:rpm/redhat/elfutils-debuginfod-client@0.190-2.el8?arch=x86_64&distro=rhel-8.10&upstream=elfutils-0.190-2.el8.src.rpm","type":"rpm","version":"0.190-2.el8","language":"","licenses":["GPLv3+ and (GPLv2+ or LGPLv3+)"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.190-2.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-25260","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"elfutils","version":"0.190-2.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-25260","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-25260","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25260","date":"2026-11-07","epss":0.00307,"percentile":0.23607}],"risk":0.10744999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-25260","description":"A NULL pointer dereference vulnerability in the elfutils library has been discovered. This vulnerability occurs within the handle_verdef() function in the readelf.c source file. A NULL pointer dereference typically happens when a program attempts to access memory using a pointer that is not pointing anywhere (i.e., it's NULL), leading to a crash or potentially exploitable behavior."},"relatedVulnerabilities":[{"id":"CVE-2024-25260","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-25260","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25260","date":"2026-11-07","epss":0.00307,"percentile":0.23607}],"urls":["https://github.com/schsiung/fuzzer_issues/issues/1","https://sourceware.org/bugzilla/show_bug.cgi?id=31058","https://sourceware.org/elfutils/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-25260","description":"elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c."}]},{"artifact":{"id":"a6e33caf1964aa8c","cpes":["cpe:2.3:a:elfutils-default-yama-scope:elfutils-default-yama-scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama-scope:elfutils_default_yama_scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama_scope:elfutils-default-yama-scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama_scope:elfutils_default_yama_scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama:elfutils-default-yama-scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default-yama:elfutils_default_yama_scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama:elfutils-default-yama-scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default_yama:elfutils_default_yama_scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default:elfutils-default-yama-scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-default:elfutils_default_yama_scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default:elfutils-default-yama-scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_default:elfutils_default_yama_scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-default-yama-scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_default_yama_scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-default-yama-scope:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_default_yama_scope:0.190-2.el8:*:*:*:*:*:*:*"],"name":"elfutils-default-yama-scope","purl":"pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=rhel-8.10&upstream=elfutils-0.190-2.el8.src.rpm","type":"rpm","version":"0.190-2.el8","language":"","licenses":["GPLv2+ or LGPLv3+"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.190-2.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-25260","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"elfutils","version":"0.190-2.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-25260","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-25260","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25260","date":"2026-11-07","epss":0.00307,"percentile":0.23607}],"risk":0.10744999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-25260","description":"A NULL pointer dereference vulnerability in the elfutils library has been discovered. This vulnerability occurs within the handle_verdef() function in the readelf.c source file. A NULL pointer dereference typically happens when a program attempts to access memory using a pointer that is not pointing anywhere (i.e., it's NULL), leading to a crash or potentially exploitable behavior."},"relatedVulnerabilities":[{"id":"CVE-2024-25260","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-25260","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25260","date":"2026-11-07","epss":0.00307,"percentile":0.23607}],"urls":["https://github.com/schsiung/fuzzer_issues/issues/1","https://sourceware.org/bugzilla/show_bug.cgi?id=31058","https://sourceware.org/elfutils/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-25260","description":"elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c."}]},{"artifact":{"id":"3c5398bcd7396776","cpes":["cpe:2.3:a:elfutils-libelf:elfutils-libelf:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-libelf:elfutils_libelf:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libelf:elfutils-libelf:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libelf:elfutils_libelf:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-libelf:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_libelf:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-libelf:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_libelf:0.190-2.el8:*:*:*:*:*:*:*"],"name":"elfutils-libelf","purl":"pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=rhel-8.10&upstream=elfutils-0.190-2.el8.src.rpm","type":"rpm","version":"0.190-2.el8","language":"","licenses":["GPLv2+ or LGPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.190-2.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-25260","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"elfutils","version":"0.190-2.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-25260","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-25260","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25260","date":"2026-11-07","epss":0.00307,"percentile":0.23607}],"risk":0.10744999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-25260","description":"A NULL pointer dereference vulnerability in the elfutils library has been discovered. This vulnerability occurs within the handle_verdef() function in the readelf.c source file. A NULL pointer dereference typically happens when a program attempts to access memory using a pointer that is not pointing anywhere (i.e., it's NULL), leading to a crash or potentially exploitable behavior."},"relatedVulnerabilities":[{"id":"CVE-2024-25260","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-25260","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25260","date":"2026-11-07","epss":0.00307,"percentile":0.23607}],"urls":["https://github.com/schsiung/fuzzer_issues/issues/1","https://sourceware.org/bugzilla/show_bug.cgi?id=31058","https://sourceware.org/elfutils/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-25260","description":"elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c."}]},{"artifact":{"id":"037b57594de13ebb","cpes":["cpe:2.3:a:elfutils-libs:elfutils-libs:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils-libs:elfutils_libs:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libs:elfutils-libs:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils_libs:elfutils_libs:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils-libs:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:elfutils:elfutils_libs:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils-libs:0.190-2.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:elfutils_libs:0.190-2.el8:*:*:*:*:*:*:*"],"name":"elfutils-libs","purl":"pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=rhel-8.10&upstream=elfutils-0.190-2.el8.src.rpm","type":"rpm","version":"0.190-2.el8","language":"","licenses":["GPLv2+ or LGPLv3+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"elfutils","version":"0.190-2.el8"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-25260","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"elfutils","version":"0.190-2.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2024-25260","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-25260","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25260","date":"2026-11-07","epss":0.00307,"percentile":0.23607}],"risk":0.10744999999999999,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2024-25260","description":"A NULL pointer dereference vulnerability in the elfutils library has been discovered. This vulnerability occurs within the handle_verdef() function in the readelf.c source file. A NULL pointer dereference typically happens when a program attempts to access memory using a pointer that is not pointing anywhere (i.e., it's NULL), leading to a crash or potentially exploitable behavior."},"relatedVulnerabilities":[{"id":"CVE-2024-25260","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-25260","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25260","date":"2026-11-07","epss":0.00307,"percentile":0.23607}],"urls":["https://github.com/schsiung/fuzzer_issues/issues/1","https://sourceware.org/bugzilla/show_bug.cgi?id=31058","https://sourceware.org/elfutils/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-25260","description":"elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c."}]},{"artifact":{"id":"80dcf5ae6335799a","cpes":["cpe:2.3:a:openssl:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:rpm/redhat/openssl@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-35189","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1:1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-35189","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-11-07","epss":0.00317,"percentile":0.24753}],"risk":0.10619499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-35189","description":"A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) by presenting a specially crafted certificate during a Transport Layer Security (TLS) handshake. When OpenSSL processes and caches certificate extensions containing numerous Certificate Revocation List (CRL) distribution points, it allocates an excessive amount of memory. This disproportionate memory usage can exhaust system resources and crash the affected client or server application."},"relatedVulnerabilities":[{"id":"CVE-2026-35189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-11-07","epss":0.00317,"percentile":0.24753}],"urls":["https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84","https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89","https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f","https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35189","description":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake.  This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"43e1275cad6f43e1","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl-libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openssl_libs:1\\:1.1.1k-17.el8_6:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs@1.1.1k-17.el8_6?arch=x86_64&distro=rhel-8.10&epoch=1&upstream=openssl-1.1.1k-17.el8_6.src.rpm","type":"rpm","version":"1:1.1.1k-17.el8_6","language":"","licenses":["OpenSSL and ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"1.1.1k-17.el8_6"}],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35189","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"openssl","version":"1.1.1k-17.el8_6"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-35189","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-11-07","epss":0.00317,"percentile":0.24753}],"risk":0.10619499999999998,"urls":[],"severity":"Low","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-35189","description":"A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) by presenting a specially crafted certificate during a Transport Layer Security (TLS) handshake. When OpenSSL processes and caches certificate extensions containing numerous Certificate Revocation List (CRL) distribution points, it allocates an excessive amount of memory. This disproportionate memory usage can exhaust system resources and crash the affected client or server application."},"relatedVulnerabilities":[{"id":"CVE-2026-35189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-11-07","epss":0.00317,"percentile":0.24753}],"urls":["https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84","https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89","https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f","https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35189","description":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake.  This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"9d3dac95074ed386","cpes":["cpe:2.3:a:libpcap:libpcap:14\\:1.9.1-5.el8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:libpcap:14\\:1.9.1-5.el8:*:*:*:*:*:*:*"],"name":"libpcap","purl":"pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=rhel-8.10&epoch=14&upstream=libpcap-1.9.1-5.el8.src.rpm","type":"rpm","version":"14:1.9.1-5.el8","language":"","licenses":["BSD with advertising"],"metadata":{"epoch":14,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18313","versionConstraint":"none (unknown)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"libpcap","version":"14:1.9.1-5.el8"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-18313","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18313","cwe":"CWE-401","type":"Secondary","source":"security@tcpdump.org"}],"epss":[{"cve":"CVE-2026-18313","date":"2026-11-07","epss":0.00227,"percentile":0.13439}],"risk":0.105555,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-18313","description":"A flaw was found in libpcap, specifically within the rpcapd daemon. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending specially crafted RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ messages. The rpcapd daemon allocates memory for these messages but fails to free it, leading to a memory leak. Over time, this can exhaust available memory, making the service unavailable."},"relatedVulnerabilities":[{"id":"CVE-2026-18313","cvss":[{"type":"Secondary","source":"security@tcpdump.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18313","cwe":"CWE-401","type":"Secondary","source":"security@tcpdump.org"}],"epss":[{"cve":"CVE-2026-18313","date":"2026-11-07","epss":0.00227,"percentile":0.13439}],"urls":["https://github.com/the-tcpdump-group/libpcap/commit/f9775af1a0ec76db60c7213241e6b48f1be10ac7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18313","description":"rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use.  A malicious client can cause the server to leak memory substantially faster."}]},{"artifact":{"id":"7099e1b9cc673e8a","cpes":["cpe:2.3:a:redhat:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc","purl":"pkg:rpm/redhat/glibc@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.28-251.el8_10.48"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19542","versionConstraint":"< 0:2.28-251.el8_10.48 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"0:2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-19542","fix":{"state":"fixed","versions":["0:2.28-251.el8_10.48"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:2.28-251.el8_10.48"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-11-07","epss":0.00226,"percentile":0.13319}],"risk":0.10396,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:80798","link":"https://access.redhat.com/errata/RHSA-2026:80798"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19542","description":"A flaw was found in glibc. An out-of-bounds array write vulnerability exists within the `tdelete` function. This issue occurs due to incorrect management of array sizes, which can lead to memory corruption. A local attacker with low privileges could potentially exploit this to cause a denial of service or disclose sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-19542","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-11-07","epss":0.00226,"percentile":0.13319}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34506","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."}]},{"artifact":{"id":"f9f2f96854016567","cpes":["cpe:2.3:a:glibc-common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc-common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc_common:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:redhat:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-common:2.28-251.el8_10.40:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_common:2.28-251.el8_10.40:*:*:*:*:*:*:*"],"name":"glibc-common","purl":"pkg:rpm/redhat/glibc-common@2.28-251.el8_10.40?arch=x86_64&distro=rhel-8.10&upstream=glibc-2.28-251.el8_10.40.src.rpm","type":"rpm","version":"2.28-251.el8_10.40","language":"","licenses":["LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net and ISC and Public Domain and GFDL"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/Packages","layerID":"sha256:61a454dc4af53bec8f8e5d2623d57a7b084ea8a3333bd3adca7737ac76cd217c","accessPath":"/var/lib/rpm/Packages","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc","version":"2.28-251.el8_10.40"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0:2.28-251.el8_10.48"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19542","versionConstraint":"< 0:2.28-251.el8_10.48 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"redhat","version":"8.10"},"package":{"name":"glibc","version":"2.28-251.el8_10.40"},"namespace":"redhat:distro:redhat:8"}}],"vulnerability":{"id":"CVE-2026-19542","fix":{"state":"fixed","versions":["0:2.28-251.el8_10.48"],"available":[{"date":"2026-10-13","kind":"first-observed","version":"0:2.28-251.el8_10.48"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":3.4,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-11-07","epss":0.00226,"percentile":0.13319}],"risk":0.10396,"urls":[],"severity":"Medium","namespace":"redhat:distro:redhat:8","advisories":[{"id":"RHSA-2026:80798","link":"https://access.redhat.com/errata/RHSA-2026:80798"}],"dataSource":"https://access.redhat.com/security/cve/CVE-2026-19542","description":"A flaw was found in glibc. An out-of-bounds array write vulnerability exists within the `tdelete` function. This issue occurs due to incorrect management of array sizes, which can lead to memory corruption. A local attacker with low privileges could potentially exploit this to cause a denial of service or disclose sensitive information."},"relatedVulnerabilities":[{"id":"CVE-2026-19542","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-11-07","epss":0.00226,"percentile":0.13319}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34506","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."}]}],"grade":"F","score":"0.00","as_of":"2026-11-09T05:26:26.609Z","grype_db_version":"2026-11-08T06:19:57.000Z"}