RHSA-2026:48758
Vulnerability from csaf_redhat - Published: 2026-07-30 11:11 - Updated: 2026-08-25 19:28Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Critical
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
jaeger:
* jaeger-2.20.0-0.8.hum1 (aarch64, x86_64)
* jaeger-2.20.0-0.8.hum1.src (src)
Security Fix(es):
jaeger:
* CVE-2026-62995
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE) standards. This vulnerability allows the library to accept JSON Web Tokens (JWTs) that include non-standard trailing padding. An attacker could exploit this to create malleable JWTs, potentially bypassing security mechanisms like token revocation or anti-replay protection. This could lead to unauthorized access or continued use of tokens that should be invalid.
4.3 (Medium)
Affected products
Fixed
3 products
Threats
Impact
Moderate
A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. The excessive recursion exhausts the application's JavaScript call stack, leading to a denial of service for the affected request or, in some cases, causing the entire application process to terminate.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.
7.4 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.
7.4 (High)
Affected products
Fixed
3 products
Threats
Impact
Critical
A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
65 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\njaeger:\n * jaeger-2.20.0-0.8.hum1 (aarch64, x86_64)\n * jaeger-2.20.0-0.8.hum1.src (src)\n\nSecurity Fix(es):\n\njaeger:\n * CVE-2026-62995",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:48758",
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-62995",
"url": "https://access.redhat.com/security/cve/CVE-2026-62995"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
"url": "https://access.redhat.com/security/cve/CVE-2026-67314"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
"url": "https://access.redhat.com/security/cve/CVE-2026-67313"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67321",
"url": "https://access.redhat.com/security/cve/CVE-2026-67321"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67312",
"url": "https://access.redhat.com/security/cve/CVE-2026-67312"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67320",
"url": "https://access.redhat.com/security/cve/CVE-2026-67320"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73086",
"url": "https://access.redhat.com/security/cve/CVE-2026-73086"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48758.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-25T19:28:01+00:00",
"generator": {
"date": "2026-08-25T19:28:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:48758",
"initial_release_date": "2026-07-30T11:11:12+00:00",
"revision_history": [
{
"date": "2026-07-30T11:11:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-22T06:15:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-25T19:28:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "jaeger-main@aarch64",
"product": {
"name": "jaeger-main@aarch64",
"product_id": "jaeger-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "jaeger-main@src",
"product": {
"name": "jaeger-main@src",
"product_id": "jaeger-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jaeger-main@x86_64",
"product": {
"name": "jaeger-main@x86_64",
"product_id": "jaeger-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jaeger-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jaeger-main@aarch64"
},
"product_reference": "jaeger-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jaeger-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jaeger-main@src"
},
"product_reference": "jaeger-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jaeger-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jaeger-main@x86_64"
},
"product_reference": "jaeger-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-62995",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-07-29T19:02:04.532795+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2508524"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE) standards. This vulnerability allows the library to accept JSON Web Tokens (JWTs) that include non-standard trailing padding. An attacker could exploit this to create malleable JWTs, potentially bypassing security mechanisms like token revocation or anti-replay protection. This could lead to unauthorized access or continued use of tokens that should be invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "joserfc: joserfc: JWT Malleability via Non-Standard Padding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: The joserfc Python library, utilized across various Red Hat products, is susceptible to JWT malleability due to its handling of non-standard trailing padding. This flaw could enable an attacker to bypass token revocation or anti-replay mechanisms in applications that depend on the integrity of JWTs processed by vulnerable versions of the library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-62995"
},
{
"category": "external",
"summary": "RHBZ#2508524",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508524"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-62995",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62995"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-62995",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62995"
},
{
"category": "external",
"summary": "https://github.com/authlib/joserfc/security/advisories/GHSA-5jhw-7jv7-qcqq",
"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-5jhw-7jv7-qcqq"
}
],
"release_date": "2026-07-29T18:27:06.518000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "joserfc: joserfc: JWT Malleability via Non-Standard Padding"
},
{
"cve": "CVE-2026-67312",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-08-01T13:02:36.502842+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510007"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. The excessive recursion exhausts the application\u0027s JavaScript call stack, leading to a denial of service for the affected request or, in some cases, causing the entire application process to terminate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service via uncontrolled recursion in form data processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the axios JavaScript library allows an unauthenticated remote attacker to cause a denial of service. By submitting crafted form data with excessively nested bracket-delimited field names, an attacker can trigger uncontrolled recursion in the formDataToJSON function (exposed as axios.formToJSON() and used internally by the default transformRequest when FormData is sent with Content-Type: application/json), exhausting the JavaScript call stack and causing a RangeError that may terminate the application process. This vulnerability affects applications that pass attacker-controlled FormData field names to axios\u0027 FormData-to-JSON conversion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67312"
},
{
"category": "external",
"summary": "RHBZ#2510007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510007"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67312"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67312",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67312"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson",
"url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson"
}
],
"release_date": "2026-08-01T12:22:18.102000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"category": "workaround",
"details": "Upgrade to axios \u003e= 1.18.0 (1.x) or \u003e= 0.33.0 (0.x), which add recursion depth guards to formDataToJSON. If an immediate upgrade is not possible, validate and limit the nesting depth of FormData field names before passing them to axios.formToJSON() or before sending FormData through axios with Content-Type: application/json, and ensure error handling is in place to catch RangeError exceptions from this code path.",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Denial of Service via uncontrolled recursion in form data processing"
},
{
"cve": "CVE-2026-67313",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-08-01T13:03:08.824485+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67313"
},
{
"category": "external",
"summary": "RHBZ#2510017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3",
"url": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson",
"url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"
}
],
"release_date": "2026-08-01T12:22:16.493000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
},
{
"cve": "CVE-2026-67314",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-08-01T13:03:49.884962+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510030"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67314"
},
{
"category": "external",
"summary": "RHBZ#2510030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
"url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
"url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
}
],
"release_date": "2026-08-01T12:22:16.603000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
},
{
"cve": "CVE-2026-67320",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-08-01T13:01:50.659496+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509993"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67320"
},
{
"category": "external",
"summary": "RHBZ#2509993",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509993"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67320"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc",
"url": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter",
"url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"
}
],
"release_date": "2026-08-01T12:22:17.547000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter"
},
{
"cve": "CVE-2026-67321",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-01T13:02:49.231124+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510011"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service via object serialization bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67321"
},
{
"category": "external",
"summary": "RHBZ#2510011",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67321"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23",
"url": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass",
"url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass"
}
],
"release_date": "2026-08-01T12:22:18.177000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Denial of Service via object serialization bypass"
},
{
"cve": "CVE-2026-73086",
"cwe": {
"id": "CWE-1241",
"name": "Use of Predictable Algorithm in Random Number Generator"
},
"discovery_date": "2026-08-11T17:11:45.607696+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nanoid: nanoid: Predictable ID generation due to integer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the nanoid JavaScript library allows a remote attacker to cause predictable ID generation by exploiting an integer overflow in the `nanoid(size)` function. This can lead to the compromise of session tokens, CSRF tokens, and API keys, bypassing security mechanisms. The attack requires specific conditions, contributing to its Important severity rather than Critical.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73086"
},
{
"category": "external",
"summary": "RHBZ#2514175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73086"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
"url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
"url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
"url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/releases/tag/3.3.12",
"url": "https://github.com/ai/nanoid/releases/tag/3.3.12"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/releases/tag/5.1.11",
"url": "https://github.com/ai/nanoid/releases/tag/5.1.11"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
"url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"
}
],
"release_date": "2026-08-11T16:46:23.024000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nanoid: nanoid: Predictable ID generation due to integer overflow"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…