RHSA-2026:14020

Vulnerability from csaf_redhat - Published: 2026-05-06 11:39 - Updated: 2026-07-30 13:57
Summary
Red Hat Security Advisory: Release of components for Service Telemetry Framework 1.5.7
Severity
Important
Notes
Topic: Release of components for the Service Telemetry Framework
Details: Service Telemetry Framework (STF) provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. STF then transmits the information to a centralized, receiving Red Hat OpenShift Container Platform deployment for storage, retrieval, and monitoring. Security Fixes: * pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490) * Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking (CVE-2026-24049) * Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922) * Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * Excessive resource consumption when printing error string for host certificate validation in crypto/x509 (CVE-2025-61729)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-23490

A flaw was found in pyasn1, a generic ASN.1 library for Python. A remote attacker could exploit this vulnerability by sending a specially crafted RELATIVE-OID with excessive continuation octets. This input validation vulnerability leads to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64 —
Vendor Fix fix
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64 —
Vendor Fix fix
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64 —
Vendor Fix fix
Product Identifier Version Remediation
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64 —
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64 —
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64 —
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64 —
Threats
Impact Important
CVE-2026-24049

A path traversal flaw has been discovered in the python wheel too. The unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Product Identifier Version Remediation
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64 —
Workaround
Threats
Impact Important
CVE-2026-25679

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Affected products
Product Identifier Version Remediation
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64 —
Workaround
Threats
Impact Important
CVE-2026-30922

An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.

7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Product Identifier Version Remediation
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64 —
Workaround
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64 —
Workaround
Threats
Impact Important
CVE-2026-32280

A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64 —
Vendor Fix fix
Product Identifier Version Remediation
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64 —
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64 —
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64 —
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64 —
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64 —
Unresolved product id: Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64 —
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:14020 self
https://access.redhat.com/security/cve/CVE-2026-23490 external
https://access.redhat.com/security/cve/CVE-2026-24049 external
https://access.redhat.com/security/cve/CVE-2026-25679 external
https://access.redhat.com/security/cve/CVE-2026-30922 external
https://access.redhat.com/security/cve/CVE-2026-32280 external
https://access.redhat.com/security/updates/classi… external
https://catalog.redhat.com/software/containers/search external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-23490 self
https://bugzilla.redhat.com/show_bug.cgi?id=2430472 external
https://www.cve.org/CVERecord?id=CVE-2026-23490 external
https://nvd.nist.gov/vuln/detail/CVE-2026-23490 external
https://github.com/pyasn1/pyasn1/commit/3908f1442… external
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2 external
https://github.com/pyasn1/pyasn1/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-24049 self
https://bugzilla.redhat.com/show_bug.cgi?id=2431959 external
https://www.cve.org/CVERecord?id=CVE-2026-24049 external
https://nvd.nist.gov/vuln/detail/CVE-2026-24049 external
https://github.com/pypa/wheel/commit/7a7d2de96b22… external
https://github.com/pypa/wheel/releases/tag/0.46.2 external
https://github.com/pypa/wheel/security/advisories… external
https://access.redhat.com/security/cve/CVE-2026-25679 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445356 external
https://www.cve.org/CVERecord?id=CVE-2026-25679 external
https://nvd.nist.gov/vuln/detail/CVE-2026-25679 external
https://go.dev/cl/752180 external
https://go.dev/issue/77578 external
https://groups.google.com/g/golang-announce/c/Edh… external
https://pkg.go.dev/vuln/GO-2026-4601 external
https://access.redhat.com/security/cve/CVE-2026-30922 self
https://bugzilla.redhat.com/show_bug.cgi?id=2448553 external
https://www.cve.org/CVERecord?id=CVE-2026-30922 external
https://nvd.nist.gov/vuln/detail/CVE-2026-30922 external
https://github.com/pyasn1/pyasn1/commit/25ad481c1… external
https://github.com/pyasn1/pyasn1/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-32280 self
https://bugzilla.redhat.com/show_bug.cgi?id=2456339 external
https://www.cve.org/CVERecord?id=CVE-2026-32280 external
https://nvd.nist.gov/vuln/detail/CVE-2026-32280 external
https://go.dev/cl/758320 external
https://go.dev/issue/78282 external
https://groups.google.com/g/golang-announce/c/0uY… external
https://pkg.go.dev/vuln/GO-2026-4947 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Release of components for the Service Telemetry Framework",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Service Telemetry Framework (STF) provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. STF then transmits the information to a centralized, receiving Red Hat OpenShift Container Platform deployment for storage, retrieval, and monitoring.\n\nSecurity Fixes:\n* pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490)\n* Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking (CVE-2026-24049)\n* Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n* pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)\n* Denial of Service vulnerability in certificate chain building (CVE-2026-32280)\n* Excessive resource consumption when printing error string for host certificate validation in crypto/x509 (CVE-2025-61729)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:14020",
        "url": "https://access.redhat.com/errata/RHSA-2026:14020"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-23490",
        "url": "https://access.redhat.com/security/cve/CVE-2026-23490"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-24049",
        "url": "https://access.redhat.com/security/cve/CVE-2026-24049"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-30922",
        "url": "https://access.redhat.com/security/cve/CVE-2026-30922"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32280"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14020.json"
      }
    ],
    "title": "Red Hat Security Advisory: Release of components for Service Telemetry Framework 1.5.7",
    "tracking": {
      "current_release_date": "2026-07-30T13:57:42+00:00",
      "generator": {
        "date": "2026-07-30T13:57:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:14020",
      "initial_release_date": "2026-05-06T11:39:14+00:00",
      "revision_history": [
        {
          "date": "2026-05-06T11:39:14+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-25T05:39:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-30T13:57:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Service Telemetry Framework 1.5",
                "product": {
                  "name": "Service Telemetry Framework 1.5",
                  "product_id": "Service Telemetry Framework 1.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:stf:1.5::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Service Telemetry Framework"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
                  "product_id": "registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/prometheus-webhook-snmp-rhel9@sha256%3Af491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88?arch=amd64\u0026repository_url=registry.redhat.io/stf\u0026tag=1777452540"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
                  "product_id": "registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/service-telemetry-operator-bundle@sha256%3A1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b?arch=amd64\u0026repository_url=registry.redhat.io/stf\u0026tag=1777453299"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
                  "product_id": "registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/service-telemetry-rhel9-operator@sha256%3A6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483?arch=amd64\u0026repository_url=registry.redhat.io/stf\u0026tag=1777407251"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
                  "product_id": "registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sg-bridge-rhel9@sha256%3A58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b?arch=amd64\u0026repository_url=registry.redhat.io/stf\u0026tag=1777463768"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
                  "product_id": "registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sg-core-rhel9@sha256%3A73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71?arch=amd64\u0026repository_url=registry.redhat.io/stf\u0026tag=1777452570"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
                  "product_id": "registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/smart-gateway-operator-bundle@sha256%3Afdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe?arch=amd64\u0026repository_url=registry.redhat.io/stf\u0026tag=1777464350"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64",
                "product": {
                  "name": "registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64",
                  "product_id": "registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/smart-gateway-rhel9-operator@sha256%3A247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d?arch=amd64\u0026repository_url=registry.redhat.io/stf\u0026tag=1777436150"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64 as a component of Service Telemetry Framework 1.5",
          "product_id": "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64"
        },
        "product_reference": "registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
        "relates_to_product_reference": "Service Telemetry Framework 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64 as a component of Service Telemetry Framework 1.5",
          "product_id": "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64"
        },
        "product_reference": "registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
        "relates_to_product_reference": "Service Telemetry Framework 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64 as a component of Service Telemetry Framework 1.5",
          "product_id": "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64"
        },
        "product_reference": "registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
        "relates_to_product_reference": "Service Telemetry Framework 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64 as a component of Service Telemetry Framework 1.5",
          "product_id": "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64"
        },
        "product_reference": "registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
        "relates_to_product_reference": "Service Telemetry Framework 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64 as a component of Service Telemetry Framework 1.5",
          "product_id": "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64"
        },
        "product_reference": "registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
        "relates_to_product_reference": "Service Telemetry Framework 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64 as a component of Service Telemetry Framework 1.5",
          "product_id": "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64"
        },
        "product_reference": "registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
        "relates_to_product_reference": "Service Telemetry Framework 1.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64 as a component of Service Telemetry Framework 1.5",
          "product_id": "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
        },
        "product_reference": "registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64",
        "relates_to_product_reference": "Service Telemetry Framework 1.5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-23490",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-16T20:03:33.790513+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2430472"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pyasn1, a generic ASN.1 library for Python. A remote attacker could exploit this vulnerability by sending a specially crafted RELATIVE-OID with excessive continuation octets. This input validation vulnerability leads to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
        ],
        "known_not_affected": [
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-23490"
        },
        {
          "category": "external",
          "summary": "RHBZ#2430472",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430472"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-23490",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-23490"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23490",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23490"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970",
          "url": "https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2",
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq",
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq"
        }
      ],
      "release_date": "2026-01-16T19:03:36.442000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-06T11:39:14+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14020"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID"
    },
    {
      "cve": "CVE-2026-24049",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-01-22T05:00:54.709179+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431959"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A path traversal flaw has been discovered in the python wheel too. The unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64"
        ],
        "known_not_affected": [
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24049"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431959",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431959"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24049",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24049"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24049",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24049"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef",
          "url": "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/wheel/releases/tag/0.46.2",
          "url": "https://github.com/pypa/wheel/releases/tag/0.46.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx",
          "url": "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx"
        }
      ],
      "release_date": "2026-01-22T04:02:08.706000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-06T11:39:14+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14020"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking"
    },
    {
      "cve": "CVE-2026-25679",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-03-06T22:02:11.567841+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64"
        ],
        "known_not_affected": [
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752180",
          "url": "https://go.dev/cl/752180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77578",
          "url": "https://go.dev/issue/77578"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4601",
          "url": "https://pkg.go.dev/vuln/GO-2026-4601"
        }
      ],
      "release_date": "2026-03-06T21:28:14.211000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-06T11:39:14+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14020"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "cve": "CVE-2026-30922",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-03-18T04:02:45.401296+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448553"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
        ],
        "known_not_affected": [
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-30922"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448553",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448553"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-30922",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-30922"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0",
          "url": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r",
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r"
        }
      ],
      "release_date": "2026-03-18T02:29:45.857000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-06T11:39:14+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14020"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion"
    },
    {
      "cve": "CVE-2026-32280",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-08T02:01:19.572351+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456339"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64"
        ],
        "known_not_affected": [
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
          "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456339",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/758320",
          "url": "https://go.dev/cl/758320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78282",
          "url": "https://go.dev/issue/78282"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4947",
          "url": "https://pkg.go.dev/vuln/GO-2026-4947"
        }
      ],
      "release_date": "2026-04-08T01:06:58.595000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-06T11:39:14+00:00",
          "details": "The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container\nCatalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14020"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64",
            "Service Telemetry Framework 1.5:registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.