{"schema_version":"2","view":"grouped","data":[{"id":46181,"cve_ids":["CVE-2026-114236"],"payload":{"kind":"advisory","title":"Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers","summary":"storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit","evidence":"cve:CVE-2026-114236","products":[{"name":{"value":"Confidential Compute Attestation","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"DPU kit for NVIDIA","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Multicluster Engine for Kubernetes","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Multicluster Engine for Kubernetes","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"NVIDIA JetPack 6 for RHEL","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Lightspeed","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Source-to-Image (S2I)","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Source-to-Image (S2I)","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Podman Desktop","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Certification Program for Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Developer Hub","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/25/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/26/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/27/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/28/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/29/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/30/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/31/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/32/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/33/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/34/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/35/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/36/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/37/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/38/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/39/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/40/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/41/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/42/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/43/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/44/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/45/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/46/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/47/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/48/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/49/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/50/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/51/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/52/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/53/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/54/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/55/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/56/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/57/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/58/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/59/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/60/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/61/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/62/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/63/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/64/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/65/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/66/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/67/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/68/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/69/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/70/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/71/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/72/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/73/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/74/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/75/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/76/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/77/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/78/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/79/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenStack Platform 18.0","evidence":"/containers/cna/affected/80/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Quay 3","evidence":"/containers/cna/affected/81/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Quay 3","evidence":"/containers/cna/affected/82/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Quay 3","evidence":"/containers/cna/affected/83/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-114236","aliases":["CVE-2026-114236"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"vendor":"Red Hat","product":"Confidential Compute Attestation","packageName":"openshift-sandboxed-containers/osc-podvm-builder-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:dpu_kit:4"],"vendor":"Red Hat","product":"DPU kit for NVIDIA","packageName":"dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/vulnerability-analysis-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:multicluster_engine"],"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","packageName":"multicluster-engine/assisted-service-9-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:multicluster_engine"],"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","packageName":"multicluster-engine/hive-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jetpack:6"],"vendor":"Red Hat","product":"NVIDIA JetPack 6 for RHEL","packageName":"nvidia/nvidia-jetpack-for-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_lightspeed:1"],"vendor":"Red Hat","product":"OpenShift Lightspeed","packageName":"openshift-lightspeed/lightspeed-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:source_to_image:1"],"vendor":"Red Hat","product":"OpenShift Source-to-Image (S2I)","packageName":"source-to-image/source-to-image-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:source_to_image:1"],"vendor":"Red Hat","product":"OpenShift Source-to-Image (S2I)","packageName":"source-to-image/source-to-image-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-slim-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-slim-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-26/hub-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-27/ansible-devspaces-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-27/ansible-dev-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-27/hub-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-tech-preview/ansible-devspaces-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:podman_desktop:1"],"vendor":"Red Hat","product":"Red Hat Build of Podman Desktop","packageName":"rh-podman-desktop","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:certifications:9"],"vendor":"Red Hat","product":"Red Hat Certification Program for Red Hat Enterprise Linux 9","packageName":"redhat-certification-preflight","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:rhdh:1"],"vendor":"Red Hat","product":"Red Hat Developer Hub","packageName":"rhdh/rhdh-hub-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"oci-seccomp-bpf-hook","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"podman","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"rhel10/bootc-image-builder","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"rhel10-eus/rhel-10.2-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"rhel10/rhel-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"ubi10/buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"ubi10/skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"oci-seccomp-bpf-hook","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"podman","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"rhel9/bootc-image-builder","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"rhel9-eus/rhel-9.8-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"rhel9/rhel-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"ubi9/buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"ubi9/skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"containers-common","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"grype","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"podman","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-ml-pipelines-runtime-generic-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-model-registry-job-async-upload-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"cri-o","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/kube-compare-artifacts-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/microshift-bootc-rhel10","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/microshift-bootc-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/network-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/oc-mirror-plugin-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-agent-installer-api-server-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-agent-installer-csr-approver-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-baremetal-installer-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-cli-artifacts-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-cli-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-console-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-deployer-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-helm-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-installer-artifacts-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-installer-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-local-storage-mustgather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-machine-config-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-machine-os-images-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-must-gather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-olm-catalogd-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-olm-operator-controller-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-operator-framework-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-operator-lifecycle-manager-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-operator-registry-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-ovn-kubernetes-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-secrets-store-csi-mustgather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-tests-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ptp-must-gather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"ose-crio-credential-provider","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/udi-base-rhel10","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/udi-base-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/udi-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openstack:18.0"],"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","packageName":"rhoso-operators/prometheus-podman-exporter-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quay:3"],"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-builder-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quay:3"],"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-builder-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quay:3"],"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-21T08:04:32.529Z","provider":"cve","references":["https://access.redhat.com/security/cve/CVE-2026-114236","https://bugzilla.redhat.com/show_bug.cgi?id=2558105"],"provider_metadata":{"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-21T08:04:32.529Z"}}},"related_cves":[{"value":"CVE-2026-114236","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d322196a-ac40-4262-96ba-a40cc3f24308","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114236","advisory_id":"d322196a-ac40-4262-96ba-a40cc3f24308","event_types":["advisory"],"published_at":"2026-10-25T12:38:04.432554+00:00","technologies":["confidential-compute-attestation","core-cve","dpu-kit-for-nvidia","exploit-intelligence","multicluster-engine-for-kubernetes","nvidia-jetpack-6-for-rhel","openshift-lightspeed","openshift-source-to-image-s2i","red-hat-advanced-cluster-security-4","red-hat-ansible-automation-platform-2","red-hat-build-of-podman-desktop","red-hat-certification-program-for-red-hat-enterprise-linux-9","red-hat-developer-hub","red-hat-enterprise-linux-10","red-hat-enterprise-linux-9","red-hat-hardened-images","red-hat-openshift-ai-rhoai","red-hat-openshift-container-platform-4","red-hat-openshift-dev-spaces","red-hat-openstack-platform-18-0","red-hat-quay-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T08:04:32.529+00:00","detail_url":"/advisories/advisory%3Ad322196a-ac40-4262-96ba-a40cc3f24308","group":{"id":"advisory:d322196a-ac40-4262-96ba-a40cc3f24308","revision":1,"primary_event_id":45735,"change":"published","superseded_by":[],"changed":{"id":45735,"cve_ids":["CVE-2026-114236"],"payload":{"kind":"advisory","title":"Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers","summary":"storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit","evidence":"cve:CVE-2026-114236","products":[{"name":{"value":"Confidential Compute Attestation","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"DPU kit for NVIDIA","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Multicluster Engine for Kubernetes","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Multicluster Engine for Kubernetes","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"NVIDIA JetPack 6 for RHEL","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Lightspeed","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Source-to-Image (S2I)","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Source-to-Image (S2I)","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Podman Desktop","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Certification Program for Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Developer Hub","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/25/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/26/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/27/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/28/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/29/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/30/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/31/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/32/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/33/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/34/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/35/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/36/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/37/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/38/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/39/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/40/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/41/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/42/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/43/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/44/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/45/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/46/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/47/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/48/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/49/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/50/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/51/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/52/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/53/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/54/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/55/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/56/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/57/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/58/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/59/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/60/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/61/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/62/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/63/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/64/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/65/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/66/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/67/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/68/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/69/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/70/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/71/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/72/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/73/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/74/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/75/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/76/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/77/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/78/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/79/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenStack Platform 18.0","evidence":"/containers/cna/affected/80/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Quay 3","evidence":"/containers/cna/affected/81/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Quay 3","evidence":"/containers/cna/affected/82/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Quay 3","evidence":"/containers/cna/affected/83/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-114236","aliases":["CVE-2026-114236"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"vendor":"Red Hat","product":"Confidential Compute Attestation","packageName":"openshift-sandboxed-containers/osc-podvm-builder-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:dpu_kit:4"],"vendor":"Red Hat","product":"DPU kit for NVIDIA","packageName":"dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/vulnerability-analysis-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:multicluster_engine"],"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","packageName":"multicluster-engine/assisted-service-9-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:multicluster_engine"],"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","packageName":"multicluster-engine/hive-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jetpack:6"],"vendor":"Red Hat","product":"NVIDIA JetPack 6 for RHEL","packageName":"nvidia/nvidia-jetpack-for-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_lightspeed:1"],"vendor":"Red Hat","product":"OpenShift Lightspeed","packageName":"openshift-lightspeed/lightspeed-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:source_to_image:1"],"vendor":"Red Hat","product":"OpenShift Source-to-Image (S2I)","packageName":"source-to-image/source-to-image-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:source_to_image:1"],"vendor":"Red Hat","product":"OpenShift Source-to-Image (S2I)","packageName":"source-to-image/source-to-image-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-slim-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-slim-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-26/hub-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-27/ansible-devspaces-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-27/ansible-dev-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-27/hub-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-tech-preview/ansible-devspaces-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:podman_desktop:1"],"vendor":"Red Hat","product":"Red Hat Build of Podman Desktop","packageName":"rh-podman-desktop","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:certifications:9"],"vendor":"Red Hat","product":"Red Hat Certification Program for Red Hat Enterprise Linux 9","packageName":"redhat-certification-preflight","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:rhdh:1"],"vendor":"Red Hat","product":"Red Hat Developer Hub","packageName":"rhdh/rhdh-hub-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"oci-seccomp-bpf-hook","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"podman","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"rhel10/bootc-image-builder","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"rhel10-eus/rhel-10.2-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"rhel10/rhel-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"ubi10/buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"ubi10/skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"oci-seccomp-bpf-hook","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"podman","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"rhel9/bootc-image-builder","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"rhel9-eus/rhel-9.8-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"rhel9/rhel-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"ubi9/buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"ubi9/skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"containers-common","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"grype","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"podman","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-ml-pipelines-runtime-generic-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-model-registry-job-async-upload-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"cri-o","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/kube-compare-artifacts-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/microshift-bootc-rhel10","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/microshift-bootc-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/network-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/oc-mirror-plugin-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-agent-installer-api-server-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-agent-installer-csr-approver-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-baremetal-installer-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-cli-artifacts-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-cli-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-console-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-deployer-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-helm-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-installer-artifacts-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-installer-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-local-storage-mustgather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-machine-config-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-machine-os-images-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-must-gather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-olm-catalogd-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-olm-operator-controller-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-operator-framework-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-operator-lifecycle-manager-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-operator-registry-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-ovn-kubernetes-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-secrets-store-csi-mustgather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-tests-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ptp-must-gather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"ose-crio-credential-provider","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/udi-base-rhel10","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/udi-base-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/udi-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openstack:18.0"],"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","packageName":"rhoso-operators/prometheus-podman-exporter-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quay:3"],"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-builder-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quay:3"],"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-builder-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quay:3"],"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-21T08:04:32.529Z","provider":"cve","references":["https://access.redhat.com/security/cve/CVE-2026-114236","https://bugzilla.redhat.com/show_bug.cgi?id=2558105"],"provider_metadata":{"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-21T08:04:32.529Z"}}},"related_cves":[{"value":"CVE-2026-114236","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d322196a-ac40-4262-96ba-a40cc3f24308","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114236","advisory_id":"d322196a-ac40-4262-96ba-a40cc3f24308","event_types":["advisory"],"published_at":"2026-10-25T12:38:04.432554+00:00","technologies":["confidential-compute-attestation","core-cve","dpu-kit-for-nvidia","exploit-intelligence","multicluster-engine-for-kubernetes","nvidia-jetpack-6-for-rhel","openshift-lightspeed","openshift-source-to-image-s2i","red-hat-advanced-cluster-security-4","red-hat-ansible-automation-platform-2","red-hat-build-of-podman-desktop","red-hat-certification-program-for-red-hat-enterprise-linux-9","red-hat-developer-hub","red-hat-enterprise-linux-10","red-hat-enterprise-linux-9","red-hat-hardened-images","red-hat-openshift-ai-rhoai","red-hat-openshift-container-platform-4","red-hat-openshift-dev-spaces","red-hat-openstack-platform-18-0","red-hat-quay-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T08:04:32.529+00:00","detail_url":"/events/45735"},"members":[{"id":45735,"cve_ids":["CVE-2026-114236"],"payload":{"kind":"advisory","title":"Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers","summary":"storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit","evidence":"cve:CVE-2026-114236","products":[{"name":{"value":"Confidential Compute Attestation","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"DPU kit for NVIDIA","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Multicluster Engine for Kubernetes","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Multicluster Engine for Kubernetes","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"NVIDIA JetPack 6 for RHEL","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Lightspeed","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Source-to-Image (S2I)","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Source-to-Image (S2I)","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Advanced Cluster Security 4","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Ansible Automation Platform 2","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Podman Desktop","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Certification Program for Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Developer Hub","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/25/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/26/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/27/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/28/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/29/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/30/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/31/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/32/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/33/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/34/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/35/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/36/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/37/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/38/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/39/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/40/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/41/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/42/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Hardened Images","evidence":"/containers/cna/affected/43/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/44/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/45/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/46/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/47/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/48/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/49/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/50/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/51/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/52/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/53/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/54/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/55/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/56/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/57/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/58/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/59/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/60/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/61/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/62/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/63/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/64/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/65/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/66/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/67/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/68/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/69/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/70/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/71/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/72/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/73/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/74/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/75/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Container Platform 4","evidence":"/containers/cna/affected/76/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/77/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/78/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/79/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenStack Platform 18.0","evidence":"/containers/cna/affected/80/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Quay 3","evidence":"/containers/cna/affected/81/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Quay 3","evidence":"/containers/cna/affected/82/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Quay 3","evidence":"/containers/cna/affected/83/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-114236","aliases":["CVE-2026-114236"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"vendor":"Red Hat","product":"Confidential Compute Attestation","packageName":"openshift-sandboxed-containers/osc-podvm-builder-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:dpu_kit:4"],"vendor":"Red Hat","product":"DPU kit for NVIDIA","packageName":"dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/vulnerability-analysis-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:multicluster_engine"],"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","packageName":"multicluster-engine/assisted-service-9-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:multicluster_engine"],"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","packageName":"multicluster-engine/hive-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jetpack:6"],"vendor":"Red Hat","product":"NVIDIA JetPack 6 for RHEL","packageName":"nvidia/nvidia-jetpack-for-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_lightspeed:1"],"vendor":"Red Hat","product":"OpenShift Lightspeed","packageName":"openshift-lightspeed/lightspeed-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:source_to_image:1"],"vendor":"Red Hat","product":"OpenShift Source-to-Image (S2I)","packageName":"source-to-image/source-to-image-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:source_to_image:1"],"vendor":"Red Hat","product":"OpenShift Source-to-Image (S2I)","packageName":"source-to-image/source-to-image-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-slim-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"advanced-cluster-security/rhacs-scanner-slim-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-26/hub-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-27/ansible-devspaces-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-27/ansible-dev-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-27/hub-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-tech-preview/ansible-devspaces-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:podman_desktop:1"],"vendor":"Red Hat","product":"Red Hat Build of Podman Desktop","packageName":"rh-podman-desktop","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:certifications:9"],"vendor":"Red Hat","product":"Red Hat Certification Program for Red Hat Enterprise Linux 9","packageName":"redhat-certification-preflight","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:rhdh:1"],"vendor":"Red Hat","product":"Red Hat Developer Hub","packageName":"rhdh/rhdh-hub-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"oci-seccomp-bpf-hook","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"podman","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"rhel10/bootc-image-builder","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"rhel10-eus/rhel-10.2-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"rhel10/rhel-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"ubi10/buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"ubi10/skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"oci-seccomp-bpf-hook","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"podman","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"rhel9/bootc-image-builder","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"rhel9-eus/rhel-9.8-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"rhel9/rhel-bootc","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"ubi9/buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"ubi9/skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"buildah","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"containers-common","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"grype","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"podman","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:hummingbird:1"],"vendor":"Red Hat","product":"Red Hat Hardened Images","packageName":"skopeo","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-ml-pipelines-runtime-generic-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-model-registry-job-async-upload-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"cri-o","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/kube-compare-artifacts-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/microshift-bootc-rhel10","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/microshift-bootc-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/network-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/oc-mirror-plugin-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-agent-installer-api-server-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-agent-installer-csr-approver-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-baremetal-installer-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-cli-artifacts-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-cli-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-console-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-deployer-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-helm-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-installer-artifacts-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-installer-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-local-storage-mustgather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-machine-config-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-machine-os-images-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-must-gather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-olm-catalogd-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-olm-operator-controller-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-operator-framework-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-operator-lifecycle-manager-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-operator-registry-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-ovn-kubernetes-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-secrets-store-csi-mustgather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-tests-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-tools-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ptp-must-gather-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift:4"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"ose-crio-credential-provider","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/udi-base-rhel10","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/udi-base-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/udi-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:openstack:18.0"],"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","packageName":"rhoso-operators/prometheus-podman-exporter-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quay:3"],"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-builder-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quay:3"],"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-builder-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quay:3"],"vendor":"Red Hat","product":"Red Hat Quay 3","packageName":"quay/quay-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-21T08:04:32.529Z","provider":"cve","references":["https://access.redhat.com/security/cve/CVE-2026-114236","https://bugzilla.redhat.com/show_bug.cgi?id=2558105"],"provider_metadata":{"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-21T08:04:32.529Z"}}},"related_cves":[{"value":"CVE-2026-114236","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d322196a-ac40-4262-96ba-a40cc3f24308","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114236","advisory_id":"d322196a-ac40-4262-96ba-a40cc3f24308","event_types":["advisory"],"published_at":"2026-10-25T12:38:04.432554+00:00","technologies":["confidential-compute-attestation","core-cve","dpu-kit-for-nvidia","exploit-intelligence","multicluster-engine-for-kubernetes","nvidia-jetpack-6-for-rhel","openshift-lightspeed","openshift-source-to-image-s2i","red-hat-advanced-cluster-security-4","red-hat-ansible-automation-platform-2","red-hat-build-of-podman-desktop","red-hat-certification-program-for-red-hat-enterprise-linux-9","red-hat-developer-hub","red-hat-enterprise-linux-10","red-hat-enterprise-linux-9","red-hat-hardened-images","red-hat-openshift-ai-rhoai","red-hat-openshift-container-platform-4","red-hat-openshift-dev-spaces","red-hat-openstack-platform-18-0","red-hat-quay-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T08:04:32.529+00:00","detail_url":"/events/45735"}]}},{"id":32561,"cve_ids":["CVE-2026-94451"],"payload":{"kind":"advisory","title":"Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache","summary":"Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.","evidence":"cve:CVE-2026-94451","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-94451","aliases":["CVE-2026-94451"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-15T23:41:42.312Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-94451","https://bugzilla.redhat.com/show_bug.cgi?id=2537516"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-94451","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T02:55:56.121203Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T02:56:08.403Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:41:42.312Z"}}},"related_cves":[{"value":"CVE-2026-94451","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9dd55194-7240-4bab-a8d4-91d635b0dea7","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-94451","advisory_id":"9dd55194-7240-4bab-a8d4-91d635b0dea7","event_types":["advisory"],"published_at":"2026-10-25T08:47:03.076711+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T16:26:59.851+00:00","detail_url":"/advisories/advisory%3A9dd55194-7240-4bab-a8d4-91d635b0dea7","group":{"id":"advisory:9dd55194-7240-4bab-a8d4-91d635b0dea7","revision":1,"primary_event_id":32293,"change":"published","superseded_by":[],"changed":{"id":32293,"cve_ids":["CVE-2026-94451"],"payload":{"kind":"advisory","title":"Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache","summary":"Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.","evidence":"cve:CVE-2026-94451","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-94451","aliases":["CVE-2026-94451"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-15T23:41:42.312Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-94451","https://bugzilla.redhat.com/show_bug.cgi?id=2537516"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-94451","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T02:55:56.121203Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T02:56:08.403Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:41:42.312Z"}}},"related_cves":[{"value":"CVE-2026-94451","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9dd55194-7240-4bab-a8d4-91d635b0dea7","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-94451","advisory_id":"9dd55194-7240-4bab-a8d4-91d635b0dea7","event_types":["advisory"],"published_at":"2026-10-25T08:47:03.076711+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T16:26:59.851+00:00","detail_url":"/events/32293"},"members":[{"id":32293,"cve_ids":["CVE-2026-94451"],"payload":{"kind":"advisory","title":"Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache","summary":"Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.","evidence":"cve:CVE-2026-94451","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-94451","aliases":["CVE-2026-94451"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-15T23:41:42.312Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-94451","https://bugzilla.redhat.com/show_bug.cgi?id=2537516"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-94451","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T02:55:56.121203Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T02:56:08.403Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:41:42.312Z"}}},"related_cves":[{"value":"CVE-2026-94451","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9dd55194-7240-4bab-a8d4-91d635b0dea7","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-94451","advisory_id":"9dd55194-7240-4bab-a8d4-91d635b0dea7","event_types":["advisory"],"published_at":"2026-10-25T08:47:03.076711+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T16:26:59.851+00:00","detail_url":"/events/32293"}]}},{"id":32560,"cve_ids":["CVE-2026-93432"],"payload":{"kind":"advisory","title":"Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus","summary":"A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.","evidence":"cve:CVE-2026-93432","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93432","aliases":["CVE-2026-93432"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus.qute/qute-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus.qute/qute-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"qute-generator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"rhbk/keycloak-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"qute-generator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"qute-generator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T23:41:36.020Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-93432","https://bugzilla.redhat.com/show_bug.cgi?id=2536859"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93432","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T19:48:06.603188Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T19:48:17.558Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:41:36.020Z"}}},"related_cves":[{"value":"CVE-2026-93432","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8d39a01d-9016-4f6f-9d94-f2499a125313","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93432","advisory_id":"8d39a01d-9016-4f6f-9d94-f2499a125313","event_types":["advisory"],"published_at":"2026-10-25T08:47:02.512833+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apicurio-registry-3","red-hat-build-of-keycloak","red-hat-build-of-quarkus","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat","red-hat-fuse-7"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T17:53:19.772+00:00","detail_url":"/advisories/advisory%3A8d39a01d-9016-4f6f-9d94-f2499a125313","group":{"id":"advisory:8d39a01d-9016-4f6f-9d94-f2499a125313","revision":1,"primary_event_id":32292,"change":"published","superseded_by":[],"changed":{"id":32292,"cve_ids":["CVE-2026-93432"],"payload":{"kind":"advisory","title":"Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus","summary":"A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.","evidence":"cve:CVE-2026-93432","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93432","aliases":["CVE-2026-93432"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus.qute/qute-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus.qute/qute-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"qute-generator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"rhbk/keycloak-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"qute-generator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"qute-generator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T23:41:36.020Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-93432","https://bugzilla.redhat.com/show_bug.cgi?id=2536859"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93432","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T19:48:06.603188Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T19:48:17.558Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:41:36.020Z"}}},"related_cves":[{"value":"CVE-2026-93432","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8d39a01d-9016-4f6f-9d94-f2499a125313","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93432","advisory_id":"8d39a01d-9016-4f6f-9d94-f2499a125313","event_types":["advisory"],"published_at":"2026-10-25T08:47:02.512833+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apicurio-registry-3","red-hat-build-of-keycloak","red-hat-build-of-quarkus","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat","red-hat-fuse-7"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T17:53:19.772+00:00","detail_url":"/events/32292"},"members":[{"id":32292,"cve_ids":["CVE-2026-93432"],"payload":{"kind":"advisory","title":"Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus","summary":"A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.","evidence":"cve:CVE-2026-93432","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93432","aliases":["CVE-2026-93432"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus.qute/qute-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus.qute/qute-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"qute-generator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"rhbk/keycloak-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"qute-generator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"qute-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"qute-generator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T23:41:36.020Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-93432","https://bugzilla.redhat.com/show_bug.cgi?id=2536859"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93432","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T19:48:06.603188Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T19:48:17.558Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:41:36.020Z"}}},"related_cves":[{"value":"CVE-2026-93432","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8d39a01d-9016-4f6f-9d94-f2499a125313","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93432","advisory_id":"8d39a01d-9016-4f6f-9d94-f2499a125313","event_types":["advisory"],"published_at":"2026-10-25T08:47:02.512833+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apicurio-registry-3","red-hat-build-of-keycloak","red-hat-build-of-quarkus","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat","red-hat-fuse-7"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T17:53:19.772+00:00","detail_url":"/events/32292"}]}},{"id":32558,"cve_ids":["CVE-2026-94449"],"payload":{"kind":"advisory","title":"Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service","summary":"A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.","evidence":"cve:CVE-2026-94449","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-94449","aliases":["CVE-2026-94449"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"}],"modified":"2026-10-15T23:12:09.202Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-94449","https://bugzilla.redhat.com/show_bug.cgi?id=2537502"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-94449","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-21T17:51:33.511604Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-21T17:51:45.100Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:12:09.202Z"}}},"related_cves":[{"value":"CVE-2026-94449","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ef1762e9-4de9-4fd2-b9c3-b690f2ddc955","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-94449","advisory_id":"ef1762e9-4de9-4fd2-b9c3-b690f2ddc955","event_types":["advisory"],"published_at":"2026-10-25T08:47:01.036714+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apicurio-registry-3","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat","red-hat-fuse-7"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T17:01:48.617+00:00","detail_url":"/advisories/advisory%3Aef1762e9-4de9-4fd2-b9c3-b690f2ddc955","group":{"id":"advisory:ef1762e9-4de9-4fd2-b9c3-b690f2ddc955","revision":1,"primary_event_id":32290,"change":"published","superseded_by":[],"changed":{"id":32290,"cve_ids":["CVE-2026-94449"],"payload":{"kind":"advisory","title":"Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service","summary":"A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.","evidence":"cve:CVE-2026-94449","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-94449","aliases":["CVE-2026-94449"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"}],"modified":"2026-10-15T23:12:09.202Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-94449","https://bugzilla.redhat.com/show_bug.cgi?id=2537502"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-94449","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-21T17:51:33.511604Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-21T17:51:45.100Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:12:09.202Z"}}},"related_cves":[{"value":"CVE-2026-94449","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ef1762e9-4de9-4fd2-b9c3-b690f2ddc955","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-94449","advisory_id":"ef1762e9-4de9-4fd2-b9c3-b690f2ddc955","event_types":["advisory"],"published_at":"2026-10-25T08:47:01.036714+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apicurio-registry-3","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat","red-hat-fuse-7"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T17:01:48.617+00:00","detail_url":"/events/32290"},"members":[{"id":32290,"cve_ids":["CVE-2026-94449"],"payload":{"kind":"advisory","title":"Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service","summary":"A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.","evidence":"cve:CVE-2026-94449","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-94449","aliases":["CVE-2026-94449"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"quarkus-smallrye-fault-tolerance","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"}],"modified":"2026-10-15T23:12:09.202Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-94449","https://bugzilla.redhat.com/show_bug.cgi?id=2537502"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-94449","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-21T17:51:33.511604Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-21T17:51:45.100Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:12:09.202Z"}}},"related_cves":[{"value":"CVE-2026-94449","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ef1762e9-4de9-4fd2-b9c3-b690f2ddc955","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-94449","advisory_id":"ef1762e9-4de9-4fd2-b9c3-b690f2ddc955","event_types":["advisory"],"published_at":"2026-10-25T08:47:01.036714+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apicurio-registry-3","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat","red-hat-fuse-7"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T17:01:48.617+00:00","detail_url":"/events/32290"}]}},{"id":32557,"cve_ids":["CVE-2026-87744"],"payload":{"kind":"advisory","title":"Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations","summary":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","evidence":"cve:CVE-2026-87744","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-87744","aliases":["CVE-2026-87744"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T23:11:43.650Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-87744","https://bugzilla.redhat.com/show_bug.cgi?id=2530524"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87744","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T13:23:57.266757Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:14:18.713Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:11:43.650Z"}}},"related_cves":[{"value":"CVE-2026-87744","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f0a61686-cb72-43fa-8409-1c43560fc629","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87744","advisory_id":"f0a61686-cb72-43fa-8409-1c43560fc629","event_types":["advisory"],"published_at":"2026-10-25T08:47:00.408868+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T18:41:46.751+00:00","detail_url":"/advisories/advisory%3Af0a61686-cb72-43fa-8409-1c43560fc629","group":{"id":"advisory:f0a61686-cb72-43fa-8409-1c43560fc629","revision":1,"primary_event_id":32289,"change":"published","superseded_by":[],"changed":{"id":32289,"cve_ids":["CVE-2026-87744"],"payload":{"kind":"advisory","title":"Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations","summary":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","evidence":"cve:CVE-2026-87744","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-87744","aliases":["CVE-2026-87744"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T23:11:43.650Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-87744","https://bugzilla.redhat.com/show_bug.cgi?id=2530524"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87744","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T13:23:57.266757Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:14:18.713Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:11:43.650Z"}}},"related_cves":[{"value":"CVE-2026-87744","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f0a61686-cb72-43fa-8409-1c43560fc629","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87744","advisory_id":"f0a61686-cb72-43fa-8409-1c43560fc629","event_types":["advisory"],"published_at":"2026-10-25T08:47:00.408868+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T18:41:46.751+00:00","detail_url":"/events/32289"},"members":[{"id":32289,"cve_ids":["CVE-2026-87744"],"payload":{"kind":"advisory","title":"Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations","summary":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","evidence":"cve:CVE-2026-87744","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.6.redhat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.4.redhat","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-87744","aliases":["CVE-2026-87744"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.6.redhat","versions":[{"status":"unaffected","version":"3.27.6.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.4.redhat","versions":[{"status":"unaffected","version":"3.33.4.redhat-00004","lessThan":"*","versionType":"rpm"}],"packageName":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T23:11:43.650Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-87744","https://bugzilla.redhat.com/show_bug.cgi?id=2530524"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87744","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T13:23:57.266757Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:14:18.713Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T23:11:43.650Z"}}},"related_cves":[{"value":"CVE-2026-87744","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f0a61686-cb72-43fa-8409-1c43560fc629","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87744","advisory_id":"f0a61686-cb72-43fa-8409-1c43560fc629","event_types":["advisory"],"published_at":"2026-10-25T08:47:00.408868+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-quarkus-3-27-6-redhat","red-hat-build-of-quarkus-3-33-4-redhat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T18:41:46.751+00:00","detail_url":"/events/32289"}]}},{"id":16452,"cve_ids":["CVE-2026-81829"],"payload":{"kind":"advisory","title":"Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver","summary":"A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.","evidence":"cve:CVE-2026-81829","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-81829","aliases":["CVE-2026-81829"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"quarkus-smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"quarkus-smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"quarkus-smallrye-jwt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"}],"modified":"2026-10-09T16:26:17.785Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/security/cve/CVE-2026-81829","https://bugzilla.redhat.com/show_bug.cgi?id=2524980"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-81829","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-17T15:45:20.084526Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-17T15:45:29.941Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-09T16:26:17.785Z"}}},"related_cves":[{"value":"CVE-2026-81829","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6bd40026-ff22-4618-a285-4c2ccfb94918","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81829","advisory_id":"6bd40026-ff22-4618-a285-4c2ccfb94918","event_types":["advisory"],"published_at":"2026-10-25T01:15:30.32831+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-apicurio-registry-3","red-hat-build-of-quarkus","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-expansion-pack"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T14:01:30.083+00:00","detail_url":"/advisories/advisory%3A6bd40026-ff22-4618-a285-4c2ccfb94918","group":{"id":"advisory:6bd40026-ff22-4618-a285-4c2ccfb94918","revision":1,"primary_event_id":16352,"change":"published","superseded_by":[],"changed":{"id":16352,"cve_ids":["CVE-2026-81829"],"payload":{"kind":"advisory","title":"Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver","summary":"A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.","evidence":"cve:CVE-2026-81829","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-81829","aliases":["CVE-2026-81829"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"quarkus-smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"quarkus-smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"quarkus-smallrye-jwt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"}],"modified":"2026-10-09T16:26:17.785Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/security/cve/CVE-2026-81829","https://bugzilla.redhat.com/show_bug.cgi?id=2524980"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-81829","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-17T15:45:20.084526Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-17T15:45:29.941Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-09T16:26:17.785Z"}}},"related_cves":[{"value":"CVE-2026-81829","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6bd40026-ff22-4618-a285-4c2ccfb94918","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81829","advisory_id":"6bd40026-ff22-4618-a285-4c2ccfb94918","event_types":["advisory"],"published_at":"2026-10-25T01:15:30.32831+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-apicurio-registry-3","red-hat-build-of-quarkus","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-expansion-pack"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T14:01:30.083+00:00","detail_url":"/events/16352"},"members":[{"id":16352,"cve_ids":["CVE-2026-81829"],"payload":{"kind":"advisory","title":"Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver","summary":"A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.","evidence":"cve:CVE-2026-81829","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-81829","aliases":["CVE-2026-81829"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"quarkus-smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"quarkus-smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"quarkus-smallrye-jwt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"smallrye-jwt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"}],"modified":"2026-10-09T16:26:17.785Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/security/cve/CVE-2026-81829","https://bugzilla.redhat.com/show_bug.cgi?id=2524980"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-81829","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-17T15:45:20.084526Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-17T15:45:29.941Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-09T16:26:17.785Z"}}},"related_cves":[{"value":"CVE-2026-81829","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6bd40026-ff22-4618-a285-4c2ccfb94918","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81829","advisory_id":"6bd40026-ff22-4618-a285-4c2ccfb94918","event_types":["advisory"],"published_at":"2026-10-25T01:15:30.32831+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-apicurio-registry-3","red-hat-build-of-quarkus","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-expansion-pack"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T14:01:30.083+00:00","detail_url":"/events/16352"}]}},{"id":16434,"cve_ids":["CVE-2026-87743"],"payload":{"kind":"advisory","title":"Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security","summary":"A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.","evidence":"cve:CVE-2026-87743","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Debezium 3","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-87743","aliases":["CVE-2026-87743"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:debezium:3"],"vendor":"Red Hat","product":"Red Hat build of Debezium 3","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"keycloak/rhbk-openshift-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"keycloak/rhbk-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"rhbk/keycloak-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"rhbk/keycloak-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/multicluster-redirector-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-09T15:37:08.568Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/security/cve/CVE-2026-87743","https://bugzilla.redhat.com/show_bug.cgi?id=2530523"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87743","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-22T14:15:59.292451Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-22T14:16:36.091Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-09T15:37:08.568Z"}}},"related_cves":[{"value":"CVE-2026-87743","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0a1371b2-f90c-4821-8836-781bea98539d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87743","advisory_id":"0a1371b2-f90c-4821-8836-781bea98539d","event_types":["advisory"],"published_at":"2026-10-25T01:14:07.706784+00:00","technologies":["core-cve","exploit-intelligence","openshift-serverless","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-fuse-7","red-hat-openshift-ai-rhoai","red-hat-openshift-dev-spaces"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T09:38:27.326+00:00","detail_url":"/advisories/advisory%3A0a1371b2-f90c-4821-8836-781bea98539d","group":{"id":"advisory:0a1371b2-f90c-4821-8836-781bea98539d","revision":1,"primary_event_id":16334,"change":"published","superseded_by":[],"changed":{"id":16334,"cve_ids":["CVE-2026-87743"],"payload":{"kind":"advisory","title":"Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security","summary":"A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.","evidence":"cve:CVE-2026-87743","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Debezium 3","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-87743","aliases":["CVE-2026-87743"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:debezium:3"],"vendor":"Red Hat","product":"Red Hat build of Debezium 3","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"keycloak/rhbk-openshift-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"keycloak/rhbk-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"rhbk/keycloak-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"rhbk/keycloak-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/multicluster-redirector-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-09T15:37:08.568Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/security/cve/CVE-2026-87743","https://bugzilla.redhat.com/show_bug.cgi?id=2530523"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87743","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-22T14:15:59.292451Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-22T14:16:36.091Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-09T15:37:08.568Z"}}},"related_cves":[{"value":"CVE-2026-87743","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0a1371b2-f90c-4821-8836-781bea98539d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87743","advisory_id":"0a1371b2-f90c-4821-8836-781bea98539d","event_types":["advisory"],"published_at":"2026-10-25T01:14:07.706784+00:00","technologies":["core-cve","exploit-intelligence","openshift-serverless","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-fuse-7","red-hat-openshift-ai-rhoai","red-hat-openshift-dev-spaces"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T09:38:27.326+00:00","detail_url":"/events/16334"},"members":[{"id":16334,"cve_ids":["CVE-2026-87743"],"payload":{"kind":"advisory","title":"Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security","summary":"A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.","evidence":"cve:CVE-2026-87743","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Debezium 3","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-87743","aliases":["CVE-2026-87743"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:debezium:3"],"vendor":"Red Hat","product":"Red Hat build of Debezium 3","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"keycloak/rhbk-openshift-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"keycloak/rhbk-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"rhbk/keycloak-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"rhbk/keycloak-rhel9-operator","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"quarkus-vertx-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/multicluster-redirector-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-09T15:37:08.568Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/security/cve/CVE-2026-87743","https://bugzilla.redhat.com/show_bug.cgi?id=2530523"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87743","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-22T14:15:59.292451Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-22T14:16:36.091Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-09T15:37:08.568Z"}}},"related_cves":[{"value":"CVE-2026-87743","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0a1371b2-f90c-4821-8836-781bea98539d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87743","advisory_id":"0a1371b2-f90c-4821-8836-781bea98539d","event_types":["advisory"],"published_at":"2026-10-25T01:14:07.706784+00:00","technologies":["core-cve","exploit-intelligence","openshift-serverless","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-fuse-7","red-hat-openshift-ai-rhoai","red-hat-openshift-dev-spaces"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T09:38:27.326+00:00","detail_url":"/events/16334"}]}},{"id":16433,"cve_ids":["CVE-2026-87742"],"payload":{"kind":"advisory","title":"Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering","summary":"A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).","evidence":"cve:CVE-2026-87742","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-87742","aliases":["CVE-2026-87742"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"quarkus-websockets-next","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"quarkus-websockets-next","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-cuda-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-gaudi-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-rocm-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/disk-image-cuda-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-09T15:37:02.180Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/security/cve/CVE-2026-87742","https://bugzilla.redhat.com/show_bug.cgi?id=2530522"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87742","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-17T15:19:05.994572Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-17T15:19:18.251Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-09T15:37:02.180Z"}}},"related_cves":[{"value":"CVE-2026-87742","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:84ea349a-f777-49cc-970c-02276cbe1345","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87742","advisory_id":"84ea349a-f777-49cc-970c-02276cbe1345","event_types":["advisory"],"published_at":"2026-10-25T01:14:07.144859+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-enterprise-linux-ai-rhel-ai-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T14:57:44.414+00:00","detail_url":"/advisories/advisory%3A84ea349a-f777-49cc-970c-02276cbe1345","group":{"id":"advisory:84ea349a-f777-49cc-970c-02276cbe1345","revision":1,"primary_event_id":16333,"change":"published","superseded_by":[],"changed":{"id":16333,"cve_ids":["CVE-2026-87742"],"payload":{"kind":"advisory","title":"Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering","summary":"A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).","evidence":"cve:CVE-2026-87742","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-87742","aliases":["CVE-2026-87742"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"quarkus-websockets-next","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"quarkus-websockets-next","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-cuda-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-gaudi-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-rocm-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/disk-image-cuda-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-09T15:37:02.180Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/security/cve/CVE-2026-87742","https://bugzilla.redhat.com/show_bug.cgi?id=2530522"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87742","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-17T15:19:05.994572Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-17T15:19:18.251Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-09T15:37:02.180Z"}}},"related_cves":[{"value":"CVE-2026-87742","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:84ea349a-f777-49cc-970c-02276cbe1345","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87742","advisory_id":"84ea349a-f777-49cc-970c-02276cbe1345","event_types":["advisory"],"published_at":"2026-10-25T01:14:07.144859+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-enterprise-linux-ai-rhel-ai-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T14:57:44.414+00:00","detail_url":"/events/16333"},"members":[{"id":16333,"cve_ids":["CVE-2026-87742"],"payload":{"kind":"advisory","title":"Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering","summary":"A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).","evidence":"cve:CVE-2026-87742","products":[{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Exploit Intelligence","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux AI (RHEL AI) 3","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-87742","aliases":["CVE-2026-87742"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"quarkus-websockets-next","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"quarkus-websockets-next","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:exploit_intelligence:0"],"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence/agent-client-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-cuda-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-gaudi-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-rocm-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/disk-image-cuda-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-09T15:37:02.180Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/security/cve/CVE-2026-87742","https://bugzilla.redhat.com/show_bug.cgi?id=2530522"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-87742","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-17T15:19:05.994572Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-17T15:19:18.251Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-09T15:37:02.180Z"}}},"related_cves":[{"value":"CVE-2026-87742","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:84ea349a-f777-49cc-970c-02276cbe1345","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87742","advisory_id":"84ea349a-f777-49cc-970c-02276cbe1345","event_types":["advisory"],"published_at":"2026-10-25T01:14:07.144859+00:00","technologies":["core-cve","exploit-intelligence","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-enterprise-linux-ai-rhel-ai-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T14:57:44.414+00:00","detail_url":"/events/16333"}]}}],"next_after":46181,"next_before":16433}