{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images.\nThis release updates to the latest version.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:21275",
        "url": "https://access.redhat.com/errata/RHSA-2026:21275"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/products/red-hat-update-infrastructure",
        "url": "https://access.redhat.com/products/red-hat-update-infrastructure"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-13837",
        "url": "https://access.redhat.com/security/cve/CVE-2025-13837"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14087",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14087"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14512",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14512"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-15282",
        "url": "https://access.redhat.com/security/cve/CVE-2025-15282"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-59375",
        "url": "https://access.redhat.com/security/cve/CVE-2025-59375"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-6075",
        "url": "https://access.redhat.com/security/cve/CVE-2025-6075"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-0672",
        "url": "https://access.redhat.com/security/cve/CVE-2026-0672"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-0865",
        "url": "https://access.redhat.com/security/cve/CVE-2026-0865"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-1502",
        "url": "https://access.redhat.com/security/cve/CVE-2026-1502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-2100",
        "url": "https://access.redhat.com/security/cve/CVE-2026-2100"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-2297",
        "url": "https://access.redhat.com/security/cve/CVE-2026-2297"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-29111",
        "url": "https://access.redhat.com/security/cve/CVE-2026-29111"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-31790",
        "url": "https://access.redhat.com/security/cve/CVE-2026-31790"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34982",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34982"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-35385",
        "url": "https://access.redhat.com/security/cve/CVE-2026-35385"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-35386",
        "url": "https://access.redhat.com/security/cve/CVE-2026-35386"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-35387",
        "url": "https://access.redhat.com/security/cve/CVE-2026-35387"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-35388",
        "url": "https://access.redhat.com/security/cve/CVE-2026-35388"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-35414",
        "url": "https://access.redhat.com/security/cve/CVE-2026-35414"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-35535",
        "url": "https://access.redhat.com/security/cve/CVE-2026-35535"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-3644",
        "url": "https://access.redhat.com/security/cve/CVE-2026-3644"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-40355",
        "url": "https://access.redhat.com/security/cve/CVE-2026-40355"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-40356",
        "url": "https://access.redhat.com/security/cve/CVE-2026-40356"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4224",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4224"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42945",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42945"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4519",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4519"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4786",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4786"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4878",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4878"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6100",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6100"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/5",
        "url": "https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/5"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21275.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update",
    "tracking": {
      "current_release_date": "2026-05-27T14:21:51+00:00",
      "generator": {
        "date": "2026-05-27T14:21:51+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2026:21275",
      "initial_release_date": "2026-05-27T07:45:38+00:00",
      "revision_history": [
        {
          "date": "2026-05-27T07:45:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-05-27T07:45:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-27T14:21:51+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Update Infrastructure 5",
                "product": {
                  "name": "Red Hat Update Infrastructure 5",
                  "product_id": "Red Hat Update Infrastructure 5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhui:5::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Update Infrastructure"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
                  "product_id": "registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cds-rhel9@sha256%3A29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/cds-rhel9\u0026tag=1779798159"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
                  "product_id": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/haproxy-rhel9@sha256%3Aeeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/haproxy-rhel9\u0026tag=1779798164"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
                  "product_id": "registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/installer-rhel9@sha256%3Afb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/installer-rhel9\u0026tag=1779798165"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64",
                  "product_id": "registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhua-rhel9@sha256%3Aae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/rhua-rhel9\u0026tag=1779798222"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-6075",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-10-31T17:01:47.052517+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2408891"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Python\u2019s os.path.expandvars() function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denial of service (DoS) conditions. No code execution or data exposure occurs, so the impact is limited to performance slowdown.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Quadratic complexity in os.path.expandvars() with user-controlled template",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Low rather than Moderate because it only causes a performance inefficiency without affecting code execution, data integrity, or confidentiality. The flaw lies in the algorithmic complexity of os.path.expandvars(), which can become quadratic when processing crafted input containing repetitive or nested environment variable references. Exploitation requires the attacker to control the input string passed to this function, which is uncommon in secure applications. Moreover, the impact is limited to increased CPU utilization and potential slowdown, not system compromise or data manipulation. Since the issue does not introduce memory corruption, privilege escalation, or information disclosure risks, its overall impact scope and exploitability are minimal, justifying a Low severity rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-6075"
        },
        {
          "category": "external",
          "summary": "RHBZ#2408891",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-6075",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-6075"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6075",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6075"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/136065",
          "url": "https://github.com/python/cpython/issues/136065"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/"
        }
      ],
      "release_date": "2025-10-31T16:41:34.983000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "python: Quadratic complexity in os.path.expandvars() with user-controlled template"
    },
    {
      "cve": "CVE-2025-13837",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-12-01T19:01:32.492656+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2418084"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the plistlib module in the Python standard library. The amount of data to read from a Plist file is specified in the file itself. This issue allows a specially crafted Plist file to cause an application to allocate a large amount of memory, potentially resulting in allocations errors, swapping, out-of-memory conditions or even system freezes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: Out-of-memory when loading Plist",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue can only be exploited by Python applications processing malicious or untrusted Plist files, which are not typically done in Linux systems or applications. Furthermore, this flaw can cause only a denial of service with no other security impact. Due to these reasons, this vulnerability has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-13837"
        },
        {
          "category": "external",
          "summary": "RHBZ#2418084",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-13837",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-13837"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13837",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13837"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/119342",
          "url": "https://github.com/python/cpython/issues/119342"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/119343",
          "url": "https://github.com/python/cpython/pull/119343"
        }
      ],
      "release_date": "2025-12-01T18:13:32.739000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cpython: Out-of-memory when loading Plist"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Sovereign Tech Resilience program"
          ],
          "organization": "Sovereign Tech Agency"
        },
        {
          "names": [
            "treeplus"
          ]
        }
      ],
      "cve": "CVE-2025-14087",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2025-12-05T08:35:24.744000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2419093"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glib: GLib: Buffer underflow in GVariant parser leads to heap corruption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The highest threat is to system availability due to potential application crashes when processing maliciously crafted input strings through GLib\u0027s GVariant parser. This issue affects applications that utilize g_variant_parse() on untrusted data, leading to memory corruption and possible denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14087"
        },
        {
          "category": "external",
          "summary": "RHBZ#2419093",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419093"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14087",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14087"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14087",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14087"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3834",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3834"
        }
      ],
      "release_date": "2025-12-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glib: GLib: Buffer underflow in GVariant parser leads to heap corruption"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Codean Labs"
          ]
        }
      ],
      "cve": "CVE-2025-14512",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2025-12-11T06:22:59.701000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2421339"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib\u0027s GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products because an integer overflow in GLib\u0027s GIO `escape_byte_string()` function can lead to a heap buffer overflow and denial-of-service. This occurs when processing specially crafted file or remote filesystem attribute values, requiring an attacker to provide malicious input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14512"
        },
        {
          "category": "external",
          "summary": "RHBZ#2421339",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421339"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14512",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14512"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14512",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14512"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3845",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3845"
        }
      ],
      "release_date": "2025-12-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow"
    },
    {
      "cve": "CVE-2025-15282",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-01-20T22:01:20.971828+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431366"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Missing newline filtering has been discovered in Python. User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: Header injection via newlines in data URL mediatype in Python",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-15282"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431366",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-15282",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-15282"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15282",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15282"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/143925",
          "url": "https://github.com/python/cpython/issues/143925"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/143926",
          "url": "https://github.com/python/cpython/pull/143926"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/"
        }
      ],
      "release_date": "2026-01-20T21:35:13.865000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cpython: Header injection via newlines in data URL mediatype in Python"
    },
    {
      "cve": "CVE-2025-59375",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-09-15T03:00:59.775098+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2395108"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory amplification vulnerability in libexpat allows attackers to trigger excessive dynamic memory allocations by submitting specially crafted XML input. A small input (~250 KiB) can cause the parser to allocate hundreds of megabytes, leading to denial-of-service (DoS) through memory exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is Important rather than Critical because, while it allows for significant resource exhaustion leading to denial-of-service (DoS), it does not enable arbitrary code execution, data leakage, or privilege escalation. The vulnerability stems from an uncontrolled memory amplification behavior in libexpat\u2019s parser, where a relatively small XML payload can cause disproportionately large heap allocations. However, the flaw is limited in scope to service disruption and requires the attacker to submit a crafted XML document\u2014something that can be mitigated with proper input validation and memory usage limits. Therefore, while the exploitability is high, the impact is confined to availability, not confidentiality or integrity, making it a high-severity but not critical flaw.\n\nIn Firefox and Thunderbird, where libexpat is a transitive userspace dependency, exploitation usually just crashes the application (app-level DoS), so it is classified as Moderate instead of Important.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-59375"
        },
        {
          "category": "external",
          "summary": "RHBZ#2395108",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-59375",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-59375"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-59375",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59375"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375"
        }
      ],
      "release_date": "2025-09-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing"
    },
    {
      "cve": "CVE-2026-0672",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-01-20T22:02:15.663936+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431374"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An injection flaw has been discovered in Python. When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: Header injection in http.cookies.Morsel in Python",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-0672"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431374",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-0672",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0672"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0672",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0672"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/143919",
          "url": "https://github.com/python/cpython/issues/143919"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/143920",
          "url": "https://github.com/python/cpython/pull/143920"
        }
      ],
      "release_date": "2026-01-20T21:52:33.925000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cpython: Header injection in http.cookies.Morsel in Python"
    },
    {
      "cve": "CVE-2026-0865",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "discovery_date": "2026-01-20T22:01:26.694713+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431367"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Missing newline filtering has been discovered in Python. User-controlled header names and values containing newlines can allow injecting HTTP headers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: wsgiref.headers.Headers allows header newline injection in Python",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-0865"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431367",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431367"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-0865",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0865"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0865",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0865"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/143916",
          "url": "https://github.com/python/cpython/issues/143916"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/143917",
          "url": "https://github.com/python/cpython/pull/143917"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/"
        }
      ],
      "release_date": "2026-01-20T21:26:15.274000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cpython: wsgiref.headers.Headers allows header newline injection in Python"
    },
    {
      "cve": "CVE-2026-1502",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-04-10T19:01:07.715197+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457409"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python. This vulnerability allows for the injection of extra information into HTTP communication. Specifically, the system does not properly prevent special characters (carriage return and line feed) from being included in HTTP client proxy tunnel headers or host fields.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: HTTP header injection via CR/LF in proxy tunnel headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1502"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457409",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1502",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1502"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1502",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1502"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69",
          "url": "https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/146211",
          "url": "https://github.com/python/cpython/issues/146211"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/146212",
          "url": "https://github.com/python/cpython/pull/146212"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/"
        }
      ],
      "release_date": "2026-04-10T17:54:44.121000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python: Python: HTTP header injection via CR/LF in proxy tunnel headers"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Zoltan Fridrich"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-2100",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-02-06T12:02:49.002000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437308"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This MODERATE impact flaw in p11-kit allows a remote attacker to cause an application level denial of service or unpredictable system states. Exploitation occurs when the C_DeriveKey function is called on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This affects Red Hat Enterprise Linux 9.8 and 10.2, Fedora 42 and 43, and Red Hat In-Vehicle OS 2.0. Other Red Hat products, including OpenShift Container Platform and various RHEL versions, are not affected as the vulnerable code is not present.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2100"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437308",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437308"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2100",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2100"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2100",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2100"
        },
        {
          "category": "external",
          "summary": "https://github.com/p11-glue/p11-kit/pull/740",
          "url": "https://github.com/p11-glue/p11-kit/pull/740"
        }
      ],
      "release_date": "2026-02-06T08:08:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters"
    },
    {
      "cve": "CVE-2026-2297",
      "cwe": {
        "id": "CWE-778",
        "name": "Insufficient Logging"
      },
      "discovery_date": "2026-03-04T23:01:09.396553+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2444691"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in CPython. This vulnerability allows a local user with low privileges to bypass security auditing mechanisms. The issue occurs because the SourcelessFileLoader component, responsible for handling older Python compiled files (.pyc), does not properly trigger system audit events. This oversight could enable malicious activities to go undetected, compromising the integrity of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: CPython: Logging Bypass in Legacy .pyc File Handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2297"
        },
        {
          "category": "external",
          "summary": "RHBZ#2444691",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2297",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2297"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2297",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2297"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e",
          "url": "https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e",
          "url": "https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86",
          "url": "https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/145506",
          "url": "https://github.com/python/cpython/issues/145506"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/145507",
          "url": "https://github.com/python/cpython/pull/145507"
        }
      ],
      "release_date": "2026-03-04T22:10:43.297000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "cpython: CPython: Logging Bypass in Legacy .pyc File Handling"
    },
    {
      "cve": "CVE-2026-3644",
      "cwe": {
        "id": "CWE-791",
        "name": "Incomplete Filtering of Special Elements"
      },
      "discovery_date": "2026-03-16T18:02:25.997880+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448168"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A control character validation flaw has been discovered in the Python http.cookie module. The Morsel.update(), |= operator, and unpickling paths were not patched to resolve  CVE-2026-0672, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: Incomplete control character validation in http.cookies",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3644"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448168",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3644",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3644"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3644",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3644"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4",
          "url": "https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/145599",
          "url": "https://github.com/python/cpython/issues/145599"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/145600",
          "url": "https://github.com/python/cpython/pull/145600"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/"
        }
      ],
      "release_date": "2026-03-16T17:37:31.344000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cpython: Incomplete control character validation in http.cookies"
    },
    {
      "cve": "CVE-2026-4224",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2026-03-16T19:01:54.161187+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448181"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A stack overflow flaw has been discovered in the python pyexpat module. When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. This will result in a program crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: Stack overflow parsing XML with deeply nested DTD content models",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4224"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448181",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4224",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4224"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4224",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4224"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a",
          "url": "https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3",
          "url": "https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768",
          "url": "https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/145986",
          "url": "https://github.com/python/cpython/issues/145986"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/145987",
          "url": "https://github.com/python/cpython/pull/145987"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/"
        }
      ],
      "release_date": "2026-03-16T17:52:26.639000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cpython: Stack overflow parsing XML with deeply nested DTD content models"
    },
    {
      "cve": "CVE-2026-4519",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-03-20T16:02:13.494105+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449649"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449649",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/143930",
          "url": "https://github.com/python/cpython/issues/143930"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/143931",
          "url": "https://github.com/python/cpython/pull/143931"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/"
        }
      ],
      "release_date": "2026-03-20T15:08:32.576000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs"
    },
    {
      "cve": "CVE-2026-4786",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-04-13T22:01:38.006388+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458049"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing \"%action\" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in the Python `webbrowser.open()` API allows for command injection and arbitrary code execution when processing specially crafted URLs containing \"%action\". This bypasses a previous mitigation for CVE-2026-4519.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458049",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4786",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/148169",
          "url": "https://github.com/python/cpython/issues/148169"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/148170",
          "url": "https://github.com/python/cpython/pull/148170"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/"
        }
      ],
      "release_date": "2026-04-13T21:52:19.036000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ali Raza"
          ]
        }
      ],
      "cve": "CVE-2026-4878",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-03-26T06:56:21.213270+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451615"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. A Time-of-Check-to-Time-of-Use (TOCTOU) race condition in libcap\u0027s cap_set_file() allows a local unprivileged user to escalate privileges. An attacker with write access to a parent directory can exploit a narrow window during file capability updates to redirect capabilities to an attacker-controlled file. This can lead to the injection of elevated privileges into an unintended executable when privileged processes, such as setcap or container tooling, invoke cap_set_file() on attacker-influenced paths.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451615",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4878",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554"
        }
      ],
      "release_date": "2026-04-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()"
    },
    {
      "cve": "CVE-2026-6100",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-04-13T18:01:31.970255+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457932"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python\u0027s decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The severity of this flaw is somewhat mitigated on Red Hat platforms. By default processes are not executed with root user privilege and are limited in their scope which in turn limits the impact of this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457932",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6100",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
          "url": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
          "url": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
          "url": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/148395",
          "url": "https://github.com/python/cpython/issues/148395"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/148396",
          "url": "https://github.com/python/cpython/pull/148396"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/"
        }
      ],
      "release_date": "2026-04-13T17:15:47.606000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules"
    },
    {
      "cve": "CVE-2026-29111",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-03-23T22:01:54.593547+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450505"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450505",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29111",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a",
          "url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
          "url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412",
          "url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
          "url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f",
          "url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f",
          "url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69",
          "url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6",
          "url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c",
          "url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
          "url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764",
          "url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"
        }
      ],
      "release_date": "2026-03-23T21:03:56.120000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data"
    },
    {
      "cve": "CVE-2026-31790",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-03-25T02:59:10.179000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451094"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. This flaw affects applications utilizing RSASVE key encapsulation, where an attacker-supplied invalid RSA public key is used with EVP_PKEY_encapsulate() without prior validation. This can lead to the disclosure of sensitive, uninitialized memory buffer contents to a malicious peer.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451094",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451094"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-31790",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260407.txt",
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        }
      ],
      "release_date": "2026-04-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key"
    },
    {
      "cve": "CVE-2026-34982",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-04-06T16:02:10.004743+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455400"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the `complete`, `guitabtooltip`, `printheader` options and the `mapset` function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: arbitrary command execution via modeline sandbox bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this vulnerability, an attacker needs to convince a user to open a specially crafted file. The arbitrary OS command execution is restricted to the privileges of the user running Vim, limiting the potential of a full system compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34982"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455400",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455400"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34982",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34982"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/01/1",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/01/1"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615",
          "url": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0276",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0276"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9"
        }
      ],
      "release_date": "2026-04-06T15:16:48.809000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the modeline support by adding the following command to the Vim configuration file:\n\n~~~\nset nomodeline\n~~~",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: arbitrary command execution via modeline sandbox bypass"
    },
    {
      "cve": "CVE-2026-35385",
      "cwe": {
        "id": "CWE-281",
        "name": "Improper Preservation of Permissions"
      },
      "discovery_date": "2026-04-02T17:01:07.052864+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2454469"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. When the `scp` command is used by a root user to download a file with the legacy protocol option (`-O`) and without preserving original file permissions (`-p`), the downloaded file can be installed with elevated privileges (setuid or setgid). This unexpected behavior could allow a malicious file to execute with higher permissions than intended, posing a security risk through potential privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-35385"
        },
        {
          "category": "external",
          "summary": "RHBZ#2454469",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454469"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35385",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-35385"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.3p1",
          "url": "https://www.openssh.org/releasenotes.html#10.3p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
          "url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
        }
      ],
      "release_date": "2026-04-02T16:30:59.615000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode"
    },
    {
      "cve": "CVE-2026-35386",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-04-02T18:02:24.149353+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2454506"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. This vulnerability allows a remote attacker to achieve arbitrary command execution by injecting shell metacharacters into a username provided on the command line. Exploitation requires an untrusted username and a non-default configuration of the \u0027%\u0027 character in `ssh_config`.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat products do not ship in a configuration which is subject to this vulnerability. Additionally, the impact of the command execution is limited to the scope of the specific user account which users would need to create themselves.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-35386"
        },
        {
          "category": "external",
          "summary": "RHBZ#2454506",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454506"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35386",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-35386"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35386",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35386"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.3p1",
          "url": "https://www.openssh.org/releasenotes.html#10.3p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
          "url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
        }
      ],
      "release_date": "2026-04-02T16:44:27.806000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username"
    },
    {
      "cve": "CVE-2026-35387",
      "cwe": {
        "id": "CWE-115",
        "name": "Misinterpretation of Input"
      },
      "discovery_date": "2026-04-02T18:01:38.952994+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2454494"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. This vulnerability allows the system to use unintended Elliptic Curve Digital Signature Algorithm (ECDSA) algorithms. This occurs because the configuration for accepted public key algorithms is misinterpreted, leading to the use of weaker cryptographic methods than intended. This could potentially allow an attacker to compromise the confidentiality of data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The cipher choices which may be used as a result of this flaw may provide fewer bits of security than those configured by the user, however they are all still considered cryptographically secure. Users who work in regulated environments may however find themselves using ciphers which are not approved in their regulatory environment.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-35387"
        },
        {
          "category": "external",
          "summary": "RHBZ#2454494",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454494"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35387",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-35387"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35387",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35387"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.3p1",
          "url": "https://www.openssh.org/releasenotes.html#10.3p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
          "url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
        }
      ],
      "release_date": "2026-04-02T16:52:53.623000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage"
    },
    {
      "cve": "CVE-2026-35388",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "discovery_date": "2026-04-02T18:02:01.536010+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2454500"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. This vulnerability allows for a low integrity impact due to the omission of connection multiplexing confirmation for proxy-mode multiplexing sessions. A local user, under specific and complex conditions requiring user interaction, could potentially establish a multiplexed session without explicit confirmation, leading to unintended data handling.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-35388"
        },
        {
          "category": "external",
          "summary": "RHBZ#2454500",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454500"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35388",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-35388"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35388",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35388"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.3p1",
          "url": "https://www.openssh.org/releasenotes.html#10.3p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
          "url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
        }
      ],
      "release_date": "2026-04-02T16:57:31.073000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions"
    },
    {
      "cve": "CVE-2026-35414",
      "cwe": {
        "id": "CWE-168",
        "name": "Improper Handling of Inconsistent Special Elements"
      },
      "discovery_date": "2026-04-02T18:01:25.983089+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2454490"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. This vulnerability arises from the incorrect handling of the authorized_keys principals option in uncommon scenarios. Specifically, when a principals list is used with a Certificate Authority that includes comma characters, OpenSSH may misinterpret the input. This could lead to security bypasses, potentially allowing unintended access or information disclosure in specific authentication contexts.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The risk posed by this flaw to Red Hat products is limited. The use of SSH certificates is not enabled by default and requires that users opt-in to the feature. Further, when following documented guidance ssh connections should only be permitted to non-root users which will limit the impact of this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-35414"
        },
        {
          "category": "external",
          "summary": "RHBZ#2454490",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454490"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35414",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-35414"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35414",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35414"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.3p1",
          "url": "https://www.openssh.org/releasenotes.html#10.3p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
          "url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
        }
      ],
      "release_date": "2026-04-02T17:08:15.628000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option"
    },
    {
      "cve": "CVE-2026-35535",
      "cwe": {
        "id": "CWE-272",
        "name": "Least Privilege Violation"
      },
      "discovery_date": "2026-04-03T03:01:03.124541+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2454714"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Sudo. A local user could exploit a failure in the setuid, setgid, or setgroups calls, which are used to drop privileges before running the mailer. This oversight allows for privilege escalation, enabling the user to gain elevated access on the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sudo: Sudo: Privilege escalation due to failure in privilege drop calls",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-35535"
        },
        {
          "category": "external",
          "summary": "RHBZ#2454714",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454714"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35535",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-35535"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35535",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35535"
        },
        {
          "category": "external",
          "summary": "https://bugs.debian.org/1130593",
          "url": "https://bugs.debian.org/1130593"
        },
        {
          "category": "external",
          "summary": "https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042",
          "url": "https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042"
        },
        {
          "category": "external",
          "summary": "https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69",
          "url": "https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69"
        },
        {
          "category": "external",
          "summary": "https://www.qualys.com/2026/03/10/crack-armor.txt",
          "url": "https://www.qualys.com/2026/03/10/crack-armor.txt"
        }
      ],
      "release_date": "2026-04-03T02:21:33.584000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sudo: Sudo: Privilege escalation due to failure in privilege drop calls"
    },
    {
      "cve": "CVE-2026-40355",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-04-28T07:01:45.120520+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463370"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in MIT Kerberos 5 (krb5). An unauthenticated remote attacker can exploit a NULL pointer dereference vulnerability by calling `gss_accept_sec_context()` on a system with a NegoEx mechanism registered. This can lead to the termination of the process, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: This flaw allows an unauthenticated remote attacker to cause a Denial of Service in MIT Kerberos 5 by triggering a NULL pointer dereference. Exploitation requires the NegoEx mechanism to be explicitly registered in the system\u0027s GSSAPI configuration, which is not a default state in all Red Hat environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463370",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463370"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40355"
        },
        {
          "category": "external",
          "summary": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html",
          "url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f",
          "url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f"
        },
        {
          "category": "external",
          "summary": "https://web.mit.edu/kerberos/advisories/",
          "url": "https://web.mit.edu/kerberos/advisories/"
        }
      ],
      "release_date": "2026-04-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, remove the NegoEx mechanism registration from the system\u0027s GSSAPI configuration if it is not required. This can typically be achieved by removing or commenting out the relevant entry in `/etc/gss/mech`. A restart of services utilizing Kerberos might be necessary for the changes to take effect, which could impact Kerberos-dependent functionality.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism"
    },
    {
      "cve": "CVE-2026-40356",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "discovery_date": "2026-04-28T07:01:37.543641+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463368"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in MIT Kerberos 5 (krb5). An unauthenticated remote attacker can exploit an integer underflow and an out-of-bounds read vulnerability by calling `gss_accept_sec_context()` on a system with a NegoEx mechanism registered. This can lead to the process terminating, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service vulnerability exists in MIT Kerberos 5, allowing an unauthenticated remote attacker to terminate processes. This occurs on systems where the NegoEx mechanism is registered and an application invokes `gss_accept_sec_context()`, leading to an integer underflow and out-of-bounds read.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40356"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463368",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463368"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40356",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40356"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40356",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40356"
        },
        {
          "category": "external",
          "summary": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html",
          "url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f",
          "url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f"
        },
        {
          "category": "external",
          "summary": "https://web.mit.edu/kerberos/advisories/",
          "url": "https://web.mit.edu/kerberos/advisories/"
        }
      ],
      "release_date": "2026-04-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that the NegoEx mechanism is not registered in the `/etc/gss/mech` configuration file. Removing the corresponding entry from this file will prevent the vulnerable code path from being activated. This action may impact services that rely on the NegoEx GSS-API mechanism. A restart of affected Kerberos-dependent services may be required for the change to take effect.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read"
    },
    {
      "cve": "CVE-2026-42945",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-05-13T16:04:29.017257+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NGINX, specifically within the ngx_http_rewrite_module. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests under specific rewrite configurations. This can lead to a heap buffer overflow in the NGINX worker process, which may result in arbitrary code execution if Address Space Layout Randomization (ASLR), a security technique to prevent exploitation, is disabled. Otherwise, this flaw causes a denial of service due to a restart of the NGINX worker process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nginx: NGINX: Arbitrary Code Execution Vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Critical: This flaw in NGINX\u0027s ngx_http_rewrite_module can lead to arbitrary code execution due to a heap buffer overflow if Address Space Layout Randomization (ASLR) is disabled, or a denial of service otherwise. Exploitation requires specific, non-default NGINX rewrite configurations involving unnamed PCRE captures and a question mark in the replacement string.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42945"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42945",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42945"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42945",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42945"
        },
        {
          "category": "external",
          "summary": "https://depthfirst.com/nginx-rift",
          "url": "https://depthfirst.com/nginx-rift"
        },
        {
          "category": "external",
          "summary": "https://my.f5.com/manage/s/article/K000161019",
          "url": "https://my.f5.com/manage/s/article/K000161019"
        }
      ],
      "release_date": "2026-05-13T14:12:43.971000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-27T07:45:38+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21275"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "nginx: NGINX: Arbitrary Code Execution Vulnerability"
    }
  ]
}