{
  "affected": [
    {
      "affectedData": [
        {
          "product": "linkify-it",
          "vendor": "markdown-it",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package\u0027s primary public API, has O(N\u00b2) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1."
    }
  ],
  "id": "CVE-2026-48801",
  "lastModified": "2026-07-15T20:21:13.857",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48801",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-15T12:56:10.402451Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-14T21:17:01.247",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "linkify-it"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48801"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T20:47:58Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`LinkifyIt.prototype.match` \u2014 the package\u0027s primary public API \u2014 has **O(N\u00b2) algorithmic complexity** for inputs containing many fuzzy links or emails. This is not a regex backtrack bug; it\u0027s a structural issue in the JS-level scan loop that re-slices the input and re-runs unanchored regex searches on progressively shorter tails, N times.\n\n64 KB of `\"a@b.com\\n\"` repeated burns ~2.5 s of single-threaded CPU; 128 KB takes ~10 s. Doubling the input quadruples the time \u2014 textbook O(N\u00b2).\n\nThe same cost passes through `markdown-it` (`linkify:true`) unmodified. Any service that synchronously renders untrusted Markdown with linkify enabled on a request hot-path (forums, comments, chat, wikis, AI chat UIs) inherits a worker-process DoS triggerable by a tens-of-KB request body.\n\n## Affected component\n\n- HEAD audited: `8e887d5bace3f5b09b1d1f70492fa0364ef1793d` (v5.0.0)\n- Vulnerable function: `LinkifyIt.prototype.match` \u2014 `index.mjs:528-554`\n- Re-scan call sites inside `test()`: `index.mjs:444` (fuzzy host search), `:448` (fuzzy link match), `:467` (fuzzy email match)\n- Transitive consumer: `markdown-it` (~21.6M weekly npm DLs) calls `linkify.match()` at `lib/rules_core/linkify.mjs:57` when `linkify:true`\n- **All versions affected** \u2014 the vulnerable loop exists since the initial commit (2014) through v5.0.0\n\n## Vulnerability details\n\n### The O(N\u00b2) outer loop\n\n`index.mjs:528-554`:\n\n```js\nLinkifyIt.prototype.match = function match (text) {\n  const result = []\n  let shift = 0\n  let tail = shift ? text.slice(shift) : text\n\n  while (this.test(tail)) {\n    result.push(createMatch(this, shift))\n    tail = tail.slice(this.__last_index__)   // \u003c-- re-allocates remaining tail each iteration\n    shift += this.__last_index__\n  }\n\n  if (result.length) return result\n  return null\n}\n```\n\nThe loop iterates O(N) times (once per match). Each iteration:\n1. `tail.slice()` re-allocates a string of length `|text| - shift` \u2014 O(N) per iteration\n2. `this.test(tail)` runs three unanchored regex searches over the full new `tail`:\n\n```js\n// index.mjs:444 \u2014 full-tail search\ntld_pos = text.search(this.re.host_fuzzy_test)\n// index.mjs:448 \u2014 full-tail match\nml = text.match(this.re.link_fuzzy)\n// index.mjs:467 \u2014 full-tail match\nme = text.match(this.re.email_fuzzy)\n```\n\nTotal cost: `\u03a3(N - i*c) for i=0..N = O(N\u00b2)`.\n\n### Contrast with the linear schema branch\n\nThe schema-prefixed scan in the same `test()` function does it correctly at `index.mjs:428-440`:\n\n```js\nre = this.re.schema_search\nre.lastIndex = 0\nwhile ((m = re.exec(text)) !== null) { ... }\n```\n\nThat branch uses a `g`-flag RegExp and advances `lastIndex` \u2014 linear. The fuzzy branches don\u0027t follow this pattern.\n\n## Proof of concept\n\n```bash\nmkdir /tmp/linkifyit-redos \u0026\u0026 cd /tmp/linkifyit-redos\nnpm install linkify-it@5.0.0\n\ncat \u003e poc.mjs \u003c\u003c\u0027EOF\u0027\nimport LinkifyIt from \u0027linkify-it\u0027\nconst l = new LinkifyIt()\nfor (const n of [1000, 2000, 4000, 8000, 16000]) {\n  const evil = \u0027a@b.com\\n\u0027.repeat(n)\n  const t0 = process.hrtime.bigint()\n  l.match(evil)\n  const ms = Number(process.hrtime.bigint() - t0) / 1e6\n  console.log(`n=${n} bytes=${evil.length} took ${ms.toFixed(0)} ms`)\n}\nEOF\nnode poc.mjs\n```\n\n### Measured output (Node v25.5.0, Apple Silicon)\n\n```\nn=1000  bytes=8000    took 44 ms\nn=2000  bytes=16000   took 159 ms\nn=4000  bytes=32000   took 628 ms\nn=8000  bytes=64000   took 2506 ms\nn=16000 bytes=128000  took 9948 ms\n```\n\nDoubling N \u2192 ~4\u00d7 wall-clock, consistent with O(N\u00b2).\n\n### markdown-it transitive (independently confirmed)\n\n```bash\nnpm install markdown-it@14.1.1\nnode -e \"\n  const md = require(\u0027markdown-it\u0027)({ linkify: true })\n  for (const n of [1000, 2000, 4000, 8000]) {\n    const evil = \u0027a@b.com \u0027.repeat(n)\n    const t0 = process.hrtime.bigint()\n    md.render(evil)\n    const ms = Number(process.hrtime.bigint() - t0) / 1e6\n    console.log(\u0027n=\u0027 + n + \u0027 bytes=\u0027 + evil.length + \u0027 md.render=\u0027 + ms.toFixed(0) + \u0027ms\u0027)\n  }\n\"\n```\n\n```\nn=1000 bytes=8000   md.render=45ms\nn=2000 bytes=16000  md.render=171ms\nn=4000 bytes=32000  md.render=672ms\nn=8000 bytes=64000  md.render=2636ms\n```\n\nSame quadratic curve. 64 KB is enough to burn 2.6 s in `markdown-it.render()`.\n\n## Impact\n\n- **Availability (High)**: A single HTTP request containing tens of KB of repeated email-like strings blocks one worker thread for seconds to tens of seconds. Under moderate concurrency (10-50 requests), the entire rendering tier of an affected service is wedged.\n- No confidentiality or integrity impact.\n\n**Real-world scenario**: Any service that renders untrusted Markdown with `linkify:true` on the request path \u2014 Discourse, Mattermost, GitLab CE, AI chat UIs (Open WebUI, LibreChat), wiki/note apps using markdown-it \u2014 receives a post/comment containing 64 KB of `\"a@b.com \"`. The render call blocks the worker for 2.5+ seconds. Scripted at scale, this wedges the rendering tier.\n\n## Suggested remediation\n\nThe fix is algorithmic \u2014 convert the outer scan loop to stateful regex iteration so each character is examined a constant number of times:\n\n1. Add the `g` flag to `email_fuzzy`, `link_fuzzy`, `link_no_ip_fuzzy`, `host_fuzzy_test` in `lib/re.mjs`\n2. Rewrite `test()` (or add `testAt(text, pos)`) so fuzzy branches set `re.lastIndex = pos` and call `re.exec(text)` instead of `text.match()`/`text.search()` on a sliced tail\n3. In `match()`, drop `tail = tail.slice(...)` entirely \u2014 advance a `pos` offset instead\n\nThe schema branch at `index.mjs:428-440` is already structured this way \u2014 it\u0027s the in-repo precedent for the fix.\n\n```js\n// proposed sketch\nLinkifyIt.prototype.match = function match (text) {\n  const result = []\n  let pos = 0\n  while (this.testAt(text, pos)) {\n    result.push(createMatch(this, 0))\n    pos = this.__last_index__\n  }\n  return result.length ? result : null\n}\n```\n\nTotal cost becomes O(N): each character scanned at most once per regex across the whole loop.\n\n## Duplicate-risk analysis\n\n- Zero GHSAs on `linkify-it` (`gh api /repos/markdown-it/linkify-it/security-advisories` \u2192 `[]`)\n- Zero OSV entries (`api.osv.dev/v1/query` \u2192 `{}`)\n- markdown-it\u0027s only GHSA (CVE-2022-21670, \"Possible ReDOS in newline rule\") targets markdown-it\u0027s own newline regex, not the linkify pipeline\n\nThis finding appears novel.\n\n## Note to maintainers\n\nSince `markdown-it` is the dominant consumer and shares maintainership (Vitaly Puzrin), a patched `linkify-it` release should be paired with a `markdown-it` minor that pins the new minimum version.",
  "id": "GHSA-22p9-wv53-3rq4",
  "modified": "2026-06-26T20:47:58Z",
  "published": "2026-06-26T20:47:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/markdown-it/linkify-it"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "LinkifyIt#match scan loop has quadratic algorithmic complexity"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nrust:\n  * cargo-1.97.0-1.1.hum1 (aarch64, x86_64)\n  * clippy-1.97.0-1.1.hum1 (aarch64, x86_64)\n  * rust-1.97.0-1.1.hum1 (aarch64, x86_64)\n  * rust-analyzer-1.97.0-1.1.hum1 (aarch64, x86_64)\n  * rust-debugger-common-1.97.0-1.1.hum1 (noarch)\n  * rust-doc-1.97.0-1.1.hum1 (aarch64, x86_64)\n  * rust-gdb-1.97.0-1.1.hum1 (noarch)\n  * rust-lldb-1.97.0-1.1.hum1 (noarch)\n  * rust-src-1.97.0-1.1.hum1 (noarch)\n  * rust-std-static-1.97.0-1.1.hum1 (aarch64, x86_64)\n  * rust-std-static-aarch64-unknown-none-softfloat-1.97.0-1.1.hum1 (noarch)\n  * rust-std-static-aarch64-unknown-uefi-1.97.0-1.1.hum1 (noarch)\n  * rust-std-static-i686-pc-windows-gnu-1.97.0-1.1.hum1 (noarch)\n  * rust-std-static-wasm32-unknown-unknown-1.97.0-1.1.hum1 (noarch)\n  * rust-std-static-wasm32-wasip1-1.97.0-1.1.hum1 (noarch)\n  * rust-std-static-x86_64-pc-windows-gnu-1.97.0-1.1.hum1 (noarch)\n  * rust-std-static-x86_64-unknown-none-1.97.0-1.1.hum1 (noarch)\n  * rust-std-static-x86_64-unknown-uefi-1.97.0-1.1.hum1 (noarch)\n  * rustfmt-1.97.0-1.1.hum1 (aarch64, x86_64)\n  * rust-1.97.0-1.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:38187",
        "url": "https://access.redhat.com/errata/RHSA-2026:38187"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59869",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48801",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38187.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-08-11T17:27:42+00:00",
      "generator": {
        "date": "2026-08-11T17:27:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.14"
        }
      },
      "id": "RHSA-2026:38187",
      "initial_release_date": "2026-07-11T01:14:07+00:00",
      "revision_history": [
        {
          "date": "2026-07-11T01:14:07+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-08T04:36:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-11T17:27:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rust-main@aarch64",
                "product": {
                  "name": "rust-main@aarch64",
                  "product_id": "rust-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cargo@1.97.0-1.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rust-main@x86_64",
                "product": {
                  "name": "rust-main@x86_64",
                  "product_id": "rust-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cargo@1.97.0-1.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rust-main@src",
                "product": {
                  "name": "rust-main@src",
                  "product_id": "rust-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rust@1.97.0-1.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rust-main@noarch",
                "product": {
                  "name": "rust-main@noarch",
                  "product_id": "rust-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rust-debugger-common@1.97.0-1.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rust-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:rust-main@aarch64"
        },
        "product_reference": "rust-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rust-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:rust-main@noarch"
        },
        "product_reference": "rust-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rust-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:rust-main@src"
        },
        "product_reference": "rust-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rust-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:rust-main@x86_64"
        },
        "product_reference": "rust-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-48801",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T21:02:55.149976+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500656"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package\u0027s primary public API, has an algorithmic complexity of O(N\u00b2) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in linkify-it, a link recognition library, can lead to a denial of service in Red Hat products. The vulnerability arises from an O(N\u00b2) algorithmic complexity when processing untrusted Markdown with numerous fuzzy links or emails, potentially causing excessive CPU consumption and worker-process unavailability. This risk is present in services that synchronously render untrusted Markdown with the linkify feature enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rust-main@aarch64",
          "Red Hat Hardened Images:rust-main@noarch",
          "Red Hat Hardened Images:rust-main@src",
          "Red Hat Hardened Images:rust-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500656",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500656"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159",
          "url": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4",
          "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"
        }
      ],
      "release_date": "2026-07-14T20:03:56.430000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-11T01:14:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rust-main@aarch64",
            "Red Hat Hardened Images:rust-main@noarch",
            "Red Hat Hardened Images:rust-main@src",
            "Red Hat Hardened Images:rust-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:38187"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rust-main@aarch64",
            "Red Hat Hardened Images:rust-main@noarch",
            "Red Hat Hardened Images:rust-main@src",
            "Red Hat Hardened Images:rust-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability"
    },
    {
      "cve": "CVE-2026-59869",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:38.408322+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rust-main@aarch64",
          "Red Hat Hardened Images:rust-main@noarch",
          "Red Hat Hardened Images:rust-main@src",
          "Red Hat Hardened Images:rust-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        }
      ],
      "release_date": "2026-07-08T15:15:54.675000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-11T01:14:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rust-main@aarch64",
            "Red Hat Hardened Images:rust-main@noarch",
            "Red Hat Hardened Images:rust-main@src",
            "Red Hat Hardened Images:rust-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:38187"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
          "product_ids": [
            "Red Hat Hardened Images:rust-main@aarch64",
            "Red Hat Hardened Images:rust-main@noarch",
            "Red Hat Hardened Images:rust-main@src",
            "Red Hat Hardened Images:rust-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rust-main@aarch64",
            "Red Hat Hardened Images:rust-main@noarch",
            "Red Hat Hardened Images:rust-main@src",
            "Red Hat Hardened Images:rust-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer Hub\nuser experience that simplifies the automation experience for Ansible users of all skill levels.\nThe Ansible plug-ins provide curated content and features to accelerate Ansible learner\nonboarding and streamline Ansible use case adoption across your organization.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:42815",
        "url": "https://access.redhat.com/errata/RHSA-2026:42815"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44289",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44289"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44290",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44290"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44291",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44291"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44292",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44292"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45740",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48801",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49978",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59873",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59874",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59874"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform",
        "url": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42815.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update",
    "tracking": {
      "current_release_date": "2026-08-11T09:51:18+00:00",
      "generator": {
        "date": "2026-08-11T09:51:18+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.14"
        }
      },
      "id": "RHSA-2026:42815",
      "initial_release_date": "2026-07-21T14:07:31+00:00",
      "revision_history": [
        {
          "date": "2026-07-21T14:07:31+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-08T04:36:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-11T09:51:18+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ansible Automation Platform 2.2",
                "product": {
                  "name": "Red Hat Ansible Automation Platform 2.2",
                  "product_id": "Red Hat Ansible Automation Platform 2.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_portal:2.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ansible Automation Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64",
                "product": {
                  "name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64",
                  "product_id": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/automation-portal@sha256%3A22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/automation-portal\u0026tag=1784622951"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64 as a component of Red Hat Ansible Automation Platform 2.2",
          "product_id": "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        },
        "product_reference": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64",
        "relates_to_product_reference": "Red Hat Ansible Automation Platform 2.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-13676",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-29T14:01:55.592330+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494197"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494197",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
        }
      ],
      "release_date": "2026-06-29T13:22:44.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
    },
    {
      "cve": "CVE-2026-44289",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-05-13T16:05:16.500414+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477130"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs, a library that compiles protobuf definitions into JavaScript functions. A remote attacker could exploit this vulnerability by sending a specially crafted protobuf binary payload. This payload could cause uncontrolled recursion during the decoding of nested protobuf data, leading to the exhaustion of the JavaScript call stack. This ultimately results in a Denial of Service (DoS) for applications using the affected library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An uncontrolled recursion vulnerability was discovered in protobufjs which can allow a remote attacker to cause a Denial of Service (DoS) via stack exhaustion. Red Hat products bundling vulnerable instances of this npm package (specifically versions prior to 7.5.6 and 8.0.2) are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44289"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477130",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477130"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44289",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44289"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44289",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44289"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-685m-2w69-288q",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-685m-2w69-288q"
        }
      ],
      "release_date": "2026-05-13T14:39:09.791000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "Avoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an outer protocol boundary where feasible, or isolate protobuf decoding in a process that can be safely restarted.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding"
    },
    {
      "cve": "CVE-2026-44290",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-05-13T16:03:39.540492+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477100"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs. This vulnerability allows an attacker to craft a protobuf schema or JSON descriptor that, when processed, can traverse through inherited object properties. This can lead to writing to global JavaScript constructors, corrupting process-wide built-in functionality. The most significant impact is a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted schema",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in protobufjs. A remote attacker could provide a specially crafted protobuf schema or JSON descriptor, which, when processed by an application using protobufjs, could corrupt process-wide built-in functionality, leading to a persistent denial of service. This impact is contingent on the application parsing untrusted schemas or descriptors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44290"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477100",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477100"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44290",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44290"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44290",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44290"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg"
        }
      ],
      "release_date": "2026-05-13T14:41:15.312000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, Red Hat recommends configuring applications to avoid parsing or loading protobuf schemas or JSON descriptors from untrusted sources. If processing untrusted schemas is unavoidable, implement strict validation to reject option names containing unsafe property path components before loading them. Additionally, consider running schema processing in an isolated environment to limit the blast radius of potential corruption.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted schema"
    },
    {
      "cve": "CVE-2026-44291",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-05-13T16:04:13.828371+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477111"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs, a library that compiles protobuf definitions into JavaScript functions. This prototype pollution vulnerability occurs when `Object.prototype` is polluted, allowing attacker-controlled properties to be resolved as valid protobuf type information. This can lead to attacker-controlled strings being emitted into generated JavaScript code, potentially resulting in arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in protobufjs, a JavaScript library, potentially enables arbitrary code execution when a separate prototype pollution vulnerability is present in an application. Exploitation requires an attacker to first pollute `Object.prototype` and then trigger protobufjs functionality that generates encode or decode code for affected types. Red Hat products utilizing `protobufjs` may be impacted if they are vulnerable to prototype pollution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44291"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477111",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477111"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44291",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44291"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44291",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44291"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7"
        }
      ],
      "release_date": "2026-05-13T14:42:13.984000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "Mitigation involves preventing prototype pollution within applications that utilize protobufjs. Administrators should ensure that untrusted input cannot pollute `Object.prototype` in the application or its dependencies. Additionally, isolating schema and message processing from untrusted application states can prevent attacker-controlled properties from being resolved as valid protobuf type information.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution"
    },
    {
      "cve": "CVE-2026-44292",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-05-13T16:03:03.431568+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477088"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs, a library that compiles protobuf definitions into JavaScript functions. This vulnerability allows an attacker to manipulate the internal structure of message objects. By providing a specially crafted input, an attacker could alter the prototype of individual message instances, potentially leading to unauthorized modification of data or unexpected application behavior, thereby impacting data integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Data integrity impact due to prototype pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability where `protobufjs` can be exploited for prototype pollution on individual message instances. Applications that construct `protobufjs` messages from attacker-controlled plain objects, particularly those parsing untrusted JSON input, are susceptible to data integrity issues through manipulation of the object\u0027s prototype chain. This does not affect global prototypes but can lead to unexpected application behavior.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44292"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477088",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477088"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44292"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w"
        }
      ],
      "release_date": "2026-05-13T14:42:55.155000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications should avoid directly passing attacker-controlled plain objects to protobufjs message constructors. If processing untrusted JSON input, it is crucial to validate or sanitize object keys and explicitly reject any `__proto__` properties before constructing protobuf messages. This operational control prevents the manipulation of message instance prototypes.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Data integrity impact due to prototype pollution"
    },
    {
      "cve": "CVE-2026-45740",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-05-13T16:02:41.729478+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in protobufjs, which could allow a remote attacker to exhaust the JavaScript call stack by providing a specially crafted JSON descriptor with deeply nested namespace definitions. This vulnerability impacts Red Hat products that utilize protobufjs for processing protobuf definitions potentially leading to application unresponsiveness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6"
        }
      ],
      "release_date": "2026-05-13T14:46:02.689000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid loading untrusted protobuf JSON descriptors in applications utilizing protobufjs. If untrusted descriptors must be processed, implement validation at an outer boundary to reject excessively nested structures. Alternatively, isolate the descriptor loading process in an environment that can be safely restarted in case of a denial of service.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors"
    },
    {
      "cve": "CVE-2026-48801",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T21:02:55.149976+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500656"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package\u0027s primary public API, has an algorithmic complexity of O(N\u00b2) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in linkify-it, a link recognition library, can lead to a denial of service in Red Hat products. The vulnerability arises from an O(N\u00b2) algorithmic complexity when processing untrusted Markdown with numerous fuzzy links or emails, potentially causing excessive CPU consumption and worker-process unavailability. This risk is present in services that synchronously render untrusted Markdown with the linkify feature enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500656",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500656"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159",
          "url": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4",
          "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"
        }
      ],
      "release_date": "2026-07-14T20:03:56.430000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability"
    },
    {
      "cve": "CVE-2026-49978",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-14T21:05:26.253019+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a \u003ctemplate\u003e.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500695",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
          "url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
          "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
        }
      ],
      "release_date": "2026-07-14T20:02:46.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
    },
    {
      "cve": "CVE-2026-59873",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-08T16:01:31.576716+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: node-tar: Denial of Service via crafted gzip bomb",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in node-tar is rated as Important. A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library\u0027s archive processing to craft a gzip bomb. This can lead to a denial of service by exhausting system resources such as disk space and CPU, making the affected system or application unavailable without requiring authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59873",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3",
          "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"
        }
      ],
      "release_date": "2026-07-08T15:22:40.077000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: node-tar: Denial of Service via crafted gzip bomb"
    },
    {
      "cve": "CVE-2026-59874",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:09.952291+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: Node-tar: Denial of Service via malformed tar archive header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in node-tar affects Red Hat products that process untrusted tar archives. A remote attacker can provide a specially crafted archive with a malformed header, leading to an infinite loop during parsing and causing the application to become unresponsive. This can impact the availability of services relying on node-tar for archive manipulation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59874",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5",
          "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"
        }
      ],
      "release_date": "2026-07-08T15:23:47.527000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: Node-tar: Denial of Service via malformed tar archive header"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Developer Hub (RHDH) is extensible by the plugins included herein.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:48126",
        "url": "https://access.redhat.com/errata/RHSA-2026:48126"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45740",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-46625",
        "url": "https://access.redhat.com/security/cve/CVE-2026-46625"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48068",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48068"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48069",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48069"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48801",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49978",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-5038",
        "url": "https://access.redhat.com/security/cve/CVE-2026-5038"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-5079",
        "url": "https://access.redhat.com/security/cve/CVE-2026-5079"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59869",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59877",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59877"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh",
        "url": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh"
      },
      {
        "category": "external",
        "summary": "https://developers.redhat.com/rhdh/overview",
        "url": "https://developers.redhat.com/rhdh/overview"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_developer_hub",
        "url": "https://docs.redhat.com/en/documentation/red_hat_developer_hub"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15065",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15065"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15162",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15162"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15197",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15197"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15243",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15243"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15469",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15469"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15535",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15535"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15582",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15582"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15681",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15681"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15778",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15778"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15779",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15779"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15786",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15786"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15787",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15787"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15801",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15801"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48126.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.",
    "tracking": {
      "current_release_date": "2026-08-11T17:27:55+00:00",
      "generator": {
        "date": "2026-08-11T17:27:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.14"
        }
      },
      "id": "RHSA-2026:48126",
      "initial_release_date": "2026-07-29T18:49:37+00:00",
      "revision_history": [
        {
          "date": "2026-07-29T18:49:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-08T04:36:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-11T17:27:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Developer Hub 1.10",
                "product": {
                  "name": "Red Hat Developer Hub 1.10",
                  "product_id": "Red Hat Developer Hub 1.10",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhdh:1.10::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Developer Hub"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-lightspeed@sha256%3Ab3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed\u0026tag=1785333413"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256%3A7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend\u0026tag=1785332487"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator@sha256%3A1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator\u0026tag=1785340831"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256%3Af4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend\u0026tag=1785332825"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256%3A9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki\u0026tag=1785332668"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256%3A2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets\u0026tag=1785332928"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256%3Aecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator\u0026tag=1785332694"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-5038",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-06-15T16:01:19.525752+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488935"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in multer. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by initiating and then aborting or sending malformed multipart uploads. This action leaves orphaned partial files on the disk, which can lead to the exhaustion of available disk space without requiring any specific application bug.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multer: Multer: Denial of Service via aborted or malformed multipart uploads",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5038"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488935",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488935"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5038",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5038"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5038",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5038"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm",
          "url": "https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm"
        }
      ],
      "release_date": "2026-06-15T14:23:24.230000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multer: Multer: Denial of Service via aborted or malformed multipart uploads"
    },
    {
      "cve": "CVE-2026-5079",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-06-15T15:02:06.834404+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object structures, consuming excessive CPU and memory resources. The vulnerability ultimately leads to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multer: Multer: Denial of Service via deeply nested field names in multipart form data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5079"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488927"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5079",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5079"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5079",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5079"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j",
          "url": "https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j"
        }
      ],
      "release_date": "2026-06-15T13:56:45.520000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multer: Multer: Denial of Service via deeply nested field names in multipart form data"
    },
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-13676",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-29T14:01:55.592330+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494197"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494197",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
        }
      ],
      "release_date": "2026-06-29T13:22:44.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
    },
    {
      "cve": "CVE-2026-45740",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-05-13T16:02:41.729478+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in protobufjs, which could allow a remote attacker to exhaust the JavaScript call stack by providing a specially crafted JSON descriptor with deeply nested namespace definitions. This vulnerability impacts Red Hat products that utilize protobufjs for processing protobuf definitions potentially leading to application unresponsiveness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6"
        }
      ],
      "release_date": "2026-05-13T14:46:02.689000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid loading untrusted protobuf JSON descriptors in applications utilizing protobufjs. If untrusted descriptors must be processed, implement validation at an outer boundary to reject excessively nested structures. Alternatively, isolate the descriptor loading process in an environment that can be safely restarted in case of a denial of service.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors"
    },
    {
      "cve": "CVE-2026-46625",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-06-10T22:01:17.685570+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487740"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in JavaScript Cookie (js-cookie). This vulnerability allows a remote attacker to manipulate cookie attributes by exploiting a prototype pollution issue within the `assign()` helper function. When processing specially crafted JSON input, the flaw enables an attacker to hijack the prototype of a cookie\u0027s attribute object. This allows the attacker to set sensitive cookie attributes such as `domain`, `secure`, `samesite`, `expires`, and `path`, potentially leading to security bypasses or session manipulation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46625"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487740",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487740"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46625",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46625"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46625",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46625"
        },
        {
          "category": "external",
          "summary": "https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020",
          "url": "https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020"
        },
        {
          "category": "external",
          "summary": "https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7",
          "url": "https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j",
          "url": "https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j"
        }
      ],
      "release_date": "2026-06-10T21:18:05.372000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution"
    },
    {
      "cve": "CVE-2026-48068",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-06-11T13:27:54+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499682"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote attacker can exploit this to cause a denial of service by sending a malformed HTTP/2 stream to a gRPC server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in @grpc/grpc-js. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. There is no workaround.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499682",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499682"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48068",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48068",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2",
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2"
        }
      ],
      "release_date": "2026-06-11T13:27:54+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation"
    },
    {
      "cve": "CVE-2026-48069",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-06-11T13:27:44+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499683"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming compressed message can cause a client or server process to crash. This vulnerability affects all clients and servers that use @grpc/grpc-js, and no workaround is available. An unauthenticated remote attacker can exploit this to cause a denial of service by sending a malformed compressed message over a gRPC connection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in @grpc/grpc-js. An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js. There is no workaround.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48069"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499683",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499683"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48069",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48069"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48069",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48069"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq",
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq"
        }
      ],
      "release_date": "2026-06-11T13:27:44+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message"
    },
    {
      "cve": "CVE-2026-48801",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T21:02:55.149976+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500656"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package\u0027s primary public API, has an algorithmic complexity of O(N\u00b2) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in linkify-it, a link recognition library, can lead to a denial of service in Red Hat products. The vulnerability arises from an O(N\u00b2) algorithmic complexity when processing untrusted Markdown with numerous fuzzy links or emails, potentially causing excessive CPU consumption and worker-process unavailability. This risk is present in services that synchronously render untrusted Markdown with the linkify feature enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500656",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500656"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159",
          "url": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4",
          "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"
        }
      ],
      "release_date": "2026-07-14T20:03:56.430000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability"
    },
    {
      "cve": "CVE-2026-49978",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-14T21:05:26.253019+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a \u003ctemplate\u003e.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500695",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
          "url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
          "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
        }
      ],
      "release_date": "2026-07-14T20:02:46.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
    },
    {
      "cve": "CVE-2026-59869",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:38.408322+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        }
      ],
      "release_date": "2026-07-08T15:15:54.675000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    },
    {
      "cve": "CVE-2026-59877",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-08T16:01:54.459482+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498127"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library\u0027s parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. A remote attacker can exploit this by providing a malformed schema, causing an infinite loop during parsing and leading to service unavailability. This is considered Important due to the potential for significant disruption to services that handle external protobuf definitions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498127",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498127"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59877",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217",
          "url": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f",
          "url": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/pull/2352",
          "url": "https://github.com/protobufjs/protobuf.js/pull/2352"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5",
          "url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6",
          "url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww"
        }
      ],
      "release_date": "2026-07-08T15:28:07.696000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted .proto schema"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Developer Hub 1.10.3 has been released.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Developer Hub (RHDH) is Red Hat\u0027s enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:49642",
        "url": "https://access.redhat.com/errata/RHSA-2026:49642"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45740",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-46625",
        "url": "https://access.redhat.com/security/cve/CVE-2026-46625"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48068",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48068"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48069",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48069"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48801",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49978",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-5038",
        "url": "https://access.redhat.com/security/cve/CVE-2026-5038"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-5079",
        "url": "https://access.redhat.com/security/cve/CVE-2026-5079"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59869",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59877",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59877"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59892",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59892"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh",
        "url": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh"
      },
      {
        "category": "external",
        "summary": "https://developers.redhat.com/rhdh/overview",
        "url": "https://developers.redhat.com/rhdh/overview"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_developer_hub",
        "url": "https://docs.redhat.com/en/documentation/red_hat_developer_hub"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHDHBUGS-3455",
        "url": "https://redhat.atlassian.net/browse/RHDHBUGS-3455"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHDHBUGS-3503",
        "url": "https://redhat.atlassian.net/browse/RHDHBUGS-3503"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15065",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15065"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15162",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15162"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15197",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15197"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15243",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15243"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15293",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15293"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15388",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15388"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15469",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15469"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15535",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15535"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15582",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15582"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15681",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15681"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15779",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15779"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15786",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15786"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15787",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15787"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15801",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15801"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49642.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 release.",
    "tracking": {
      "current_release_date": "2026-08-11T17:27:58+00:00",
      "generator": {
        "date": "2026-08-11T17:27:58+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.14"
        }
      },
      "id": "RHSA-2026:49642",
      "initial_release_date": "2026-08-03T10:03:58+00:00",
      "revision_history": [
        {
          "date": "2026-08-03T10:03:58+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-08T04:36:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-11T17:27:58+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Developer Hub 1.10",
                "product": {
                  "name": "Red Hat Developer Hub 1.10",
                  "product_id": "Red Hat Developer Hub 1.10",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhdh:1.10::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Developer Hub"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
                  "product_id": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-hub-rhel9@sha256%3A08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9\u0026tag=1785411652"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
                  "product_id": "registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-must-gather-rhel9@sha256%3Ad72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-must-gather-rhel9\u0026tag=1784202439"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64",
                  "product_id": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-rhel9-operator@sha256%3A483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-rhel9-operator\u0026tag=1785411290"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
                  "product_id": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-operator-bundle@sha256%3Aefb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-operator-bundle\u0026tag=1785415596"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
                  "product_id": "registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-rag-content-rhel9@sha256%3Ac0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-rag-content-rhel9\u0026tag=1785162496"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-5038",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-06-15T16:01:19.525752+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488935"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in multer. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by initiating and then aborting or sending malformed multipart uploads. This action leaves orphaned partial files on the disk, which can lead to the exhaustion of available disk space without requiring any specific application bug.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multer: Multer: Denial of Service via aborted or malformed multipart uploads",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5038"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488935",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488935"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5038",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5038"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5038",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5038"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm",
          "url": "https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm"
        }
      ],
      "release_date": "2026-06-15T14:23:24.230000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multer: Multer: Denial of Service via aborted or malformed multipart uploads"
    },
    {
      "cve": "CVE-2026-5079",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-06-15T15:02:06.834404+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object structures, consuming excessive CPU and memory resources. The vulnerability ultimately leads to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multer: Multer: Denial of Service via deeply nested field names in multipart form data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5079"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488927"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5079",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5079"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5079",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5079"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j",
          "url": "https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j"
        }
      ],
      "release_date": "2026-06-15T13:56:45.520000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multer: Multer: Denial of Service via deeply nested field names in multipart form data"
    },
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-13676",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-29T14:01:55.592330+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494197"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494197",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
        }
      ],
      "release_date": "2026-06-29T13:22:44.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
    },
    {
      "cve": "CVE-2026-42504",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-02T23:01:00.320527+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/774481",
          "url": "https://go.dev/cl/774481"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79217",
          "url": "https://go.dev/issue/79217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5038",
          "url": "https://pkg.go.dev/vuln/GO-2026-5038"
        }
      ],
      "release_date": "2026-06-02T22:01:37.219000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "cve": "CVE-2026-45740",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-05-13T16:02:41.729478+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in protobufjs, which could allow a remote attacker to exhaust the JavaScript call stack by providing a specially crafted JSON descriptor with deeply nested namespace definitions. This vulnerability impacts Red Hat products that utilize protobufjs for processing protobuf definitions potentially leading to application unresponsiveness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6"
        }
      ],
      "release_date": "2026-05-13T14:46:02.689000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid loading untrusted protobuf JSON descriptors in applications utilizing protobufjs. If untrusted descriptors must be processed, implement validation at an outer boundary to reject excessively nested structures. Alternatively, isolate the descriptor loading process in an environment that can be safely restarted in case of a denial of service.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors"
    },
    {
      "cve": "CVE-2026-46625",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-06-10T22:01:17.685570+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487740"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in JavaScript Cookie (js-cookie). This vulnerability allows a remote attacker to manipulate cookie attributes by exploiting a prototype pollution issue within the `assign()` helper function. When processing specially crafted JSON input, the flaw enables an attacker to hijack the prototype of a cookie\u0027s attribute object. This allows the attacker to set sensitive cookie attributes such as `domain`, `secure`, `samesite`, `expires`, and `path`, potentially leading to security bypasses or session manipulation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46625"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487740",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487740"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46625",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46625"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46625",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46625"
        },
        {
          "category": "external",
          "summary": "https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020",
          "url": "https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020"
        },
        {
          "category": "external",
          "summary": "https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7",
          "url": "https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j",
          "url": "https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j"
        }
      ],
      "release_date": "2026-06-10T21:18:05.372000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution"
    },
    {
      "cve": "CVE-2026-48068",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-06-11T13:27:54+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499682"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote attacker can exploit this to cause a denial of service by sending a malformed HTTP/2 stream to a gRPC server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in @grpc/grpc-js. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. There is no workaround.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499682",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499682"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48068",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48068",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2",
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2"
        }
      ],
      "release_date": "2026-06-11T13:27:54+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        },
        {
          "category": "workaround",
          "details": "Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation"
    },
    {
      "cve": "CVE-2026-48069",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-06-11T13:27:44+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499683"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming compressed message can cause a client or server process to crash. This vulnerability affects all clients and servers that use @grpc/grpc-js, and no workaround is available. An unauthenticated remote attacker can exploit this to cause a denial of service by sending a malformed compressed message over a gRPC connection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in @grpc/grpc-js. An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js. There is no workaround.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48069"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499683",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499683"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48069",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48069"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48069",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48069"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq",
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq"
        }
      ],
      "release_date": "2026-06-11T13:27:44+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        },
        {
          "category": "workaround",
          "details": "Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message"
    },
    {
      "cve": "CVE-2026-48801",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T21:02:55.149976+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500656"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package\u0027s primary public API, has an algorithmic complexity of O(N\u00b2) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in linkify-it, a link recognition library, can lead to a denial of service in Red Hat products. The vulnerability arises from an O(N\u00b2) algorithmic complexity when processing untrusted Markdown with numerous fuzzy links or emails, potentially causing excessive CPU consumption and worker-process unavailability. This risk is present in services that synchronously render untrusted Markdown with the linkify feature enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500656",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500656"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159",
          "url": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4",
          "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"
        }
      ],
      "release_date": "2026-07-14T20:03:56.430000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability"
    },
    {
      "cve": "CVE-2026-49978",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-14T21:05:26.253019+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a \u003ctemplate\u003e.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500695",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
          "url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
          "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
        }
      ],
      "release_date": "2026-07-14T20:02:46.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
    },
    {
      "cve": "CVE-2026-59869",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:38.408322+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        }
      ],
      "release_date": "2026-07-08T15:15:54.675000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    },
    {
      "cve": "CVE-2026-59877",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-08T16:01:54.459482+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498127"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library\u0027s parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. A remote attacker can exploit this by providing a malformed schema, causing an infinite loop during parsing and leading to service unavailability. This is considered Important due to the potential for significant disruption to services that handle external protobuf definitions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498127",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498127"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59877",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217",
          "url": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f",
          "url": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/pull/2352",
          "url": "https://github.com/protobufjs/protobuf.js/pull/2352"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5",
          "url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6",
          "url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww"
        }
      ],
      "release_date": "2026-07-08T15:28:07.696000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        },
        {
          "category": "workaround",
          "details": "Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted .proto schema"
    },
    {
      "cve": "CVE-2026-59892",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-07-08T17:01:08.671311+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498139"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `@opentelemetry/propagator-jaeger` component of OpenTelemetry JavaScript. This vulnerability allows an unauthenticated remote attacker to send specially crafted HTTP header values, specifically `uber-trace-id` and `uberctx-*`. The component improperly decodes these values without handling potential errors, leading to an uncaught `URIError`. Successful exploitation of this flaw can terminate a Node.js process, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "@opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects the @opentelemetry/propagator-jaeger package used by container images that configure the Jaeger trace-context propagator. Exploitation requires an unauthenticated remote actor to send a crafted uber-trace-id or uberctx-* HTTP header value to a service using JaegerPropagator as its active OpenTelemetry propagator, causing an unhandled URIError that terminates the Node.js process (Denial of Service). Red Hat CVSS score (7.5, Important) is consistent with upstream and NVD scoring.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59892"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498139",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498139"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59892",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59892"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59892",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59892"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88",
          "url": "https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0",
          "url": "https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr",
          "url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"
        }
      ],
      "release_date": "2026-07-08T16:03:58.439000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T10:03:58+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49642"
        },
        {
          "category": "workaround",
          "details": "Administrators can mitigate this issue by not configuring JaegerPropagator as the active OpenTelemetry propagator (use W3C Trace Context or B3 propagation instead), or by deploying an ingress/proxy in front of the affected service that validates or strips uber-trace-id and uberctx-* headers before they reach the application. Upgrading to @opentelemetry/propagator-jaeger \u003e= 2.9.0 resolves the issue upstream.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "@opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding"
    }
  ]
}