Inspecting raw image manifest quay.io/redhat-appstudio-qe/build-e2e-vriy/gh-multi-component-parent-ebnp@sha256:c104018c3fc8cfb46dd411d6db6ffa10134581be2ccf033479014494e04737d9.
Selecting auth
Using token for quay.io/redhat-appstudio-qe/build-e2e-vriy/gh-multi-component-parent-ebnp
Selecting auth
Using token for quay.io/redhat-appstudio-qe/build-e2e-vriy/gh-multi-component-parent-ebnp
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Downloading SBOMs this way does not ensure its authenticity. If you want to ensure a tamper-proof SBOM, download it using 'cosign download attestation <image uri>'.
Found SBOM of media type: text/spdx+json
Running TPA scan on amd64 image manifest...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
{
  "scanned" : {
    "total" : 122,
    "direct" : 18,
    "transitive" : 104
  },
  "providers" : {
    "rhtpa" : {
      "status" : {
        "ok" : false,
        "name" : "rhtpa",
        "code" : 500,
        "message" : "Exception occurred during execution on the exchange: Exchange[56A6870B49FFCB9-0000000000005865]",
        "warnings" : { }
      },
      "sources" : {
        "redhat-csaf" : {
          "summary" : {
            "direct" : 2,
            "transitive" : 15,
            "total" : 17,
            "dependencies" : 6,
            "critical" : 0,
            "high" : 4,
            "medium" : 6,
            "low" : 7,
            "unknown" : 0,
            "remediations" : 25,
            "recommendations" : 0,
            "unscanned" : 0
          },
          "dependencies" : [ {
            "ref" : "pkg:rpm/redhat/openssl-libs@3.2.2-6.el9_5.1?arch=x86_64&distro=rhel-9.6&epoch=1&upstream=openssl-3.2.2-6.el9_5.1.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-86145",
              "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
              "source" : "redhat-csaf",
              "cvssScore" : 8.2,
              "severity" : "HIGH",
              "cves" : [ "CVE-2026-86145" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "10.48-0.1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-86145",
                    "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                    "url" : "https://www.redhat.com/#CVE-2026-86145"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:67534",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_67534"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/microdnf@3.9.1-3.el9?arch=x86_64&distro=rhel-9.6&upstream=microdnf-3.9.1-3.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.6&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-34743",
                "title" : "XZ Utils: Buffer overflow in lzma_index_append()",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-34743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_2.1", "5.8.3-1.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:7647",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_7647"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.8.3-1.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-34743",
                      "title" : "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
                      "url" : "https://www.redhat.com/#CVE-2026-34743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:64787",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_64787"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=rhel-9.6&upstream=gawk-5.1.0-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40468",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40468" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40468",
                      "title" : "gawk: gawk: Memory corruption via integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40468"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40467",
                "title" : "Use after free in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40467" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40467",
                      "title" : "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c",
                      "url" : "https://www.redhat.com/#CVE-2026-40467"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40469",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 2.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-40469" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40469",
                      "title" : "gawk: gawk: Denial of Service due to integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40469"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libidn2@2.3.0-7.el9?arch=x86_64&distro=rhel-9.6&upstream=libidn2-2.3.0-7.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/popt@1.18-8.el9?arch=x86_64&distro=rhel-9.6&upstream=popt-1.18-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-18739",
                "title" : "Popt-devel: popt-static: off-by-one in poptstuffargs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18739" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18739",
                      "title" : "popt-devel: popt-static: Off-by-one in poptStuffArgs",
                      "url" : "https://www.redhat.com/#CVE-2026-18739"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-18743",
                "title" : "Popt-devel: popt-static: short realloc in poptconfigfiletostring",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18743",
                      "title" : "popt-devel: popt-static: Short realloc in poptConfigFileToString",
                      "url" : "https://www.redhat.com/#CVE-2026-18743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-18739",
                "title" : "Popt-devel: popt-static: off-by-one in poptstuffargs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18739" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18739",
                      "title" : "popt-devel: popt-static: Off-by-one in poptStuffArgs",
                      "url" : "https://www.redhat.com/#CVE-2026-18739"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-86145",
              "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
              "source" : "redhat-csaf",
              "cvssScore" : 8.2,
              "severity" : "HIGH",
              "cves" : [ "CVE-2026-86145" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "10.48-0.1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-86145",
                    "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                    "url" : "https://www.redhat.com/#CVE-2026-86145"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:67534",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_67534"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/systemd-libs@252-51.el9_6.2?arch=x86_64&distro=rhel-9.6&upstream=systemd-252-51.el9_6.2.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.6&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-34743",
                "title" : "XZ Utils: Buffer overflow in lzma_index_append()",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-34743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_2.1", "5.8.3-1.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:7647",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_7647"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.8.3-1.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-34743",
                      "title" : "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
                      "url" : "https://www.redhat.com/#CVE-2026-34743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:64787",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_64787"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-86145",
              "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
              "source" : "redhat-csaf",
              "cvssScore" : 8.2,
              "severity" : "HIGH",
              "cves" : [ "CVE-2026-86145" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "10.48-0.1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-86145",
                    "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                    "url" : "https://www.redhat.com/#CVE-2026-86145"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:67534",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_67534"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/libblkid@2.37.4-21.el9?arch=x86_64&distro=rhel-9.6&upstream=util-linux-2.37.4-21.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-86145",
              "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
              "source" : "redhat-csaf",
              "cvssScore" : 8.2,
              "severity" : "HIGH",
              "cves" : [ "CVE-2026-86145" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "10.48-0.1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-86145",
                    "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                    "url" : "https://www.redhat.com/#CVE-2026-86145"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:67534",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_67534"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/cyrus-sasl-lib@2.1.27-21.el9?arch=x86_64&distro=rhel-9.6&upstream=cyrus-sasl-2.1.27-21.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100  241k    0     0  100  241k      0   200k  0:00:01  0:00:01 --:--:--  200k
100  241k    0     0  100  241k      0   109k  0:00:02  0:00:02 --:--:--  109k
100  241k    0     0  100  241k      0  77169  0:00:03  0:00:03 --:--:-- 77169
100  241k    0     0  100  241k      0  58803  0:00:04  0:00:04 --:--:-- 58803
100  241k    0     0  100  241k      0  47499  0:00:05  0:00:05 --:--:-- 47499
100  241k    0     0  100  241k      0  39833  0:00:06  0:00:06 --:--:--     0
100  241k    0     0  100  241k      0  34303  0:00:07  0:00:07 --:--:--     0
100  241k    0     0  100  241k      0  30121  0:00:08  0:00:08 --:--:--     0
100  241k    0     0  100  241k      0  26851  0:00:09  0:00:09 --:--:--     0
100  241k    0     0  100  241k      0  24219  0:00:10  0:00:10 --:--:--     0
100  241k    0     0  100  241k      0  22055  0:00:11  0:00:11 --:--:--     0
100  241k    0     0  100  241k      0  20249  0:00:12  0:00:12 --:--:--     0
100  241k    0     0  100  241k      0  18715  0:00:13  0:00:13 --:--:--     0
100  241k    0     0  100  241k      0  17397  0:00:14  0:00:14 --:--:--     0
100  241k    0     0  100  241k      0  16253  0:00:15  0:00:15 --:--:--     0
100  241k    0     0  100  241k      0  15250  0:00:16  0:00:16 --:--:--     0
100  241k    0     0  100  241k      0  14363  0:00:17  0:00:17 --:--:--     0
100  241k    0     0  100  241k      0  13574  0:00:18  0:00:18 --:--:--     0
100  241k    0     0  100  241k      0  12868  0:00:19  0:00:19 --:--:--     0
100  241k    0     0  100  241k      0  12231  0:00:20  0:00:20 --:--:--     0
100  241k    0     0  100  241k      0  11653  0:00:21  0:00:21 --:--:--     0
100  241k    0     0  100  241k      0  11128  0:00:22  0:00:22 --:--:--     0
100  241k    0     0  100  241k      0  10649  0:00:23  0:00:23 --:--:--     0
100  241k    0     0  100  241k      0  10209  0:00:24  0:00:24 --:--:--     0
100  241k    0     0  100  241k      0   9804  0:00:25  0:00:25 --:--:--     0
100  241k    0     0  100  241k      0   9429  0:00:26  0:00:26 --:--:--     0
100  241k    0     0  100  241k      0   9083  0:00:27  0:00:27 --:--:--     0
100  241k    0     0  100  241k      0   8761  0:00:28  0:00:28 --:--:--     0
100  241k    0     0  100  241k      0   8461  0:00:29  0:00:29 --:--:--     0
100  241k    0     0  100  241k      0   8181  0:00:30  0:00:30 --:--:--     0
100  241k    0     0  100  241k      0   7918  0:00:31  0:00:31 --:--:--     0
100  241k    0     0  100  241k      0   7672  0:00:32  0:00:32 --:--:--     0
100  241k    0     0  100  241k      0   7442  0:00:33  0:00:33 --:--:--     0
100  241k    0     0  100  241k      0   7224  0:00:34  0:00:34 --:--:--     0
100  241k    0     0  100  241k      0   7019  0:00:35  0:00:35 --:--:--     0
100  241k    0     0  100  241k      0   6825  0:00:36  0:00:36 --:--:--     0
100  241k    0     0  100  241k      0   6641  0:00:37  0:00:37 --:--:--     0
100  241k    0     0  100  241k      0   6467  0:00:38  0:00:38 --:--:--     0
100  241k    0     0  100  241k      0   6302  0:00:39  0:00:39 --:--:--     0
100  241k    0     0  100  241k      0   6146  0:00:40  0:00:40 --:--:--     0
100  241k    0     0  100  241k      0   5996  0:00:41  0:00:41 --:--:--     0
100  241k    0     0  100  241k      0   5854  0:00:42  0:00:42 --:--:--     0
100  241k    0     0  100  241k      0   5719  0:00:43  0:00:43 --:--:--     0
100  241k    0     0  100  241k      0   5589  0:00:44  0:00:44 --:--:--     0
100  241k    0     0  100  241k      0   5466  0:00:45  0:00:45 --:--:--     0
100  241k    0     0  100  241k      0   5347  0:00:46  0:00:46 --:--:--     0
100  241k    0     0  100  241k      0   5234  0:00:47  0:00:47 --:--:--     0
100  241k    0     0  100  241k      0   5126  0:00:48  0:00:48 --:--:--     0
100  241k    0     0  100  241k      0   5021  0:00:49  0:00:49 --:--:--     0
100  241k    0     0  100  241k      0   4921  0:00:50  0:00:50 --:--:--     0
100  241k    0     0  100  241k      0   4825  0:00:51  0:00:51 --:--:--     0
100  241k    0     0  100  241k      0   4733  0:00:52  0:00:52 --:--:--     0
100  241k    0     0  100  241k      0   4644  0:00:53  0:00:53 --:--:--     0
100  241k    0     0  100  241k      0   4558  0:00:54  0:00:54 --:--:--     0
100  241k    0     0  100  241k      0   4475  0:00:55  0:00:55 --:--:--     0
100  241k    0     0  100  241k      0   4396  0:00:56  0:00:56 --:--:--     0
100  241k    0     0  100  241k      0   4319  0:00:57  0:00:57 --:--:--     0
100  241k    0     0  100  241k      0   4245  0:00:58  0:00:58 --:--:--     0
100  241k    0     0  100  241k      0   4173  0:00:59  0:00:59 --:--:--     0
100  241k    0     0  100  241k      0   4104  0:01:00  0:01:00 --:--:--     0
100  241k    0     0  100  241k      0   4037  0:01:01  0:01:01 --:--:--     0
100  241k    0     0  100  241k      0   3972  0:01:02  0:01:02 --:--:--     0
100  241k    0     0  100  241k      0   3909  0:01:03  0:01:03 --:--:--     0
100  241k    0     0  100  241k      0   3848  0:01:04  0:01:04 --:--:--     0
100  241k    0     0  100  241k      0   3789  0:01:05  0:01:05 --:--:--     0
100  241k    0     0  100  241k      0   3732  0:01:06  0:01:06 --:--:--     0
100  241k    0     0  100  241k      0   3676  0:01:07  0:01:07 --:--:--     0
100  241k    0     0  100  241k      0   3622  0:01:08  0:01:08 --:--:--     0
100  241k    0     0  100  241k      0   3570  0:01:09  0:01:09 --:--:--     0
100  241k    0     0  100  241k      0   3519  0:01:10  0:01:10 --:--:--     0
100  241k    0     0  100  241k      0   3470  0:01:11  0:01:11 --:--:--     0
100  241k    0     0  100  241k      0   3422  0:01:12  0:01:12 --:--:--     0
100  241k    0     0  100  241k      0   3382  0:01:13  0:01:13 --:--:--     0
100  842k    0  601k  100  241k   8406   3378  0:01:13  0:01:13 --:--:--  152k
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=rhel-9.6&upstream=gawk-5.1.0-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40468",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40468" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40468",
                      "title" : "gawk: gawk: Memory corruption via integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40468"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40467",
                "title" : "Use after free in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40467" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40467",
                      "title" : "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c",
                      "url" : "https://www.redhat.com/#CVE-2026-40467"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40469",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 2.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-40469" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40469",
                      "title" : "gawk: gawk: Denial of Service due to integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40469"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-86145",
              "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
              "source" : "redhat-csaf",
              "cvssScore" : 8.2,
              "severity" : "HIGH",
              "cves" : [ "CVE-2026-86145" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "10.48-0.1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-86145",
                    "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                    "url" : "https://www.redhat.com/#CVE-2026-86145"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:67534",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_67534"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/libusbx@1.0.26-1.el9?arch=x86_64&distro=rhel-9.6&upstream=libusbx-1.0.26-1.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.6&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-34743",
                "title" : "XZ Utils: Buffer overflow in lzma_index_append()",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-34743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_2.1", "5.8.3-1.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:7647",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_7647"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.8.3-1.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-34743",
                      "title" : "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
                      "url" : "https://www.redhat.com/#CVE-2026-34743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:64787",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_64787"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-86145",
              "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
              "source" : "redhat-csaf",
              "cvssScore" : 8.2,
              "severity" : "HIGH",
              "cves" : [ "CVE-2026-86145" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "10.48-0.1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-86145",
                    "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                    "url" : "https://www.redhat.com/#CVE-2026-86145"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:67534",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_67534"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/libsemanage@3.6-5.el9_6?arch=x86_64&distro=rhel-9.6&upstream=libsemanage-3.6-5.el9_6.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-103111",
                "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-103111" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.49-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-103111",
                      "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
                      "url" : "https://www.redhat.com/#CVE-2026-103111"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:74972",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_74972"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.49-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.49-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:74972"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89161",
                "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-89161" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89161",
                      "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
                      "url" : "https://www.redhat.com/#CVE-2026-89161"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89158",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89158" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89158",
                      "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms",
                      "url" : "https://www.redhat.com/#CVE-2026-89158"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89157",
                "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-89157" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89157",
                      "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input",
                      "url" : "https://www.redhat.com/#CVE-2026-89157"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89160",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89160" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89160",
                      "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching",
                      "url" : "https://www.redhat.com/#CVE-2026-89160"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89156",
                "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89156" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-89156",
                      "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback",
                      "url" : "https://www.redhat.com/#CVE-2026-89156"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-89162",
                "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-89162" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-89162",
                      "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode",
                      "url" : "https://www.redhat.com/#CVE-2026-89162"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-86145",
                "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
                "source" : "redhat-csaf",
                "cvssScore" : 8.2,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-86145" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "10.48-0.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-86145",
                      "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                      "url" : "https://www.redhat.com/#CVE-2026-86145"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:67534",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_67534"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "10.48-0.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "10.48-0.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-86145",
              "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).",
              "source" : "redhat-csaf",
              "cvssScore" : 8.2,
              "severity" : "HIGH",
              "cves" : [ "CVE-2026-86145" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "10.48-0.1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-86145",
                    "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
                    "url" : "https://www.redhat.com/#CVE-2026-86145"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:67534",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_67534"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "10.48-0.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "10.48-0.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:67534"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.6&upstream=xz-5.2.5-8.el9_0.src.rpm",
            "issues" : [ {
              "id" : "CVE-2025-31115",
              "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
              "source" : "redhat-csaf",
              "cvssScore" : 7.5,
              "severity" : "HIGH",
              "cves" : [ "CVE-2025-31115" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.6.2-4.el10_0" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2025-31115",
                    "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                    "url" : "https://www.redhat.com/#CVE-2025-31115"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2025:7524",
                    "title" : "Red Hat Security Advisory: xz security update",
                    "url" : "https://www.redhat.com/#RHSA-2025_7524"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                } ]
              }
            }, {
              "id" : "CVE-2026-34743",
              "title" : "XZ Utils: Buffer overflow in lzma_index_append()",
              "source" : "redhat-csaf",
              "cvssScore" : 5.3,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2026-34743" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.6.2-4.el10_2.1", "5.8.3-1.1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "RHSA-2026:7647",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                    "url" : "https://www.redhat.com/#RHSA-2026_7647"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.8.3-1.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.8.3-1.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "CVE-2026-34743",
                    "title" : "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
                    "url" : "https://www.redhat.com/#CVE-2026-34743"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_2.1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_2.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:64787",
                    "title" : "Red Hat Security Advisory: xz security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_64787"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_2.1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_2.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                  } ]
                } ]
              }
            } ],
            "transitive" : [ ],
            "highestVulnerability" : {
              "id" : "CVE-2025-31115",
              "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
              "source" : "redhat-csaf",
              "cvssScore" : 7.5,
              "severity" : "HIGH",
              "cves" : [ "CVE-2025-31115" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.6.2-4.el10_0" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2025-31115",
                    "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                    "url" : "https://www.redhat.com/#CVE-2025-31115"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2025:7524",
                    "title" : "Red Hat Security Advisory: xz security update",
                    "url" : "https://www.redhat.com/#RHSA-2025_7524"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/gnutls@3.8.3-6.el9_6.2?arch=x86_64&distro=rhel-9.6&upstream=gnutls-3.8.3-6.el9_6.2.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/libidn2@2.3.0-7.el9?arch=x86_64&distro=rhel-9.6&upstream=libidn2-2.3.0-7.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-57053",
              "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
              "source" : "redhat-csaf",
              "cvssScore" : 2.9,
              "severity" : "LOW",
              "cves" : [ "CVE-2026-57053" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "2.3.8-4.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "RHSA-2026:42125",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                    "url" : "https://www.redhat.com/#RHSA-2026_42125"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.3.8-4.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.3.8-4.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "CVE-2026-57053",
                    "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                    "url" : "https://www.redhat.com/#CVE-2026-57053"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.3.8-4.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.3.8-4.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                  } ]
                } ]
              }
            }
          } ]
        }
      },
      "recommendations" : { }
    }
  },
  "licenses" : [ {
    "status" : {
      "ok" : true,
      "name" : "deps.dev",
      "code" : 200,
      "message" : "OK",
      "warnings" : { }
    },
    "summary" : {
      "total" : 0,
      "concluded" : 110,
      "permissive" : 0,
      "weakCopyleft" : 0,
      "strongCopyleft" : 0,
      "unknown" : 0,
      "deprecated" : 0,
      "osiApproved" : 0,
      "fsfLibre" : 0
    },
    "packages" : {
      "pkg:rpm/redhat/libzstd@1.5.5-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/json-c@0.14-11.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glib2@2.68.4-16.el9_6.2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libusbx@1.0.26-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libselinux@3.6-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcap-ng@0.8.2-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libgpg-error@1.42-5.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/microdnf@3.9.1-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libunistring@0.9.10-15.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libmount@2.37.4-21.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/krb5-libs@1.21.1-8.el9_6" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/setup@2.13.7-10.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glibc-common@2.34-168.el9_6.23" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libpeas@1.30.0-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/openssl-fips-provider@3.0.7-6.el9_5" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libdnf@0.69.0-13.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/basesystem@11-13.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libgcc@11.5.0-5.el9_5" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcap@2.48-9.el9_2" : {
        "evidence" : [ ]
      },
      "pkg:oci/gh-multi-component-parent-ebnp@sha256%3Ac104018c3fc8cfb46dd411d6db6ffa10134581be2ccf033479014494e04737d9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libidn2@2.3.0-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/grep@3.6-5.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/audit-libs@3.1.5-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsigsegv@2.13-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/ca-certificates@2024.2.69_v8.0.303-91.4.el9_4" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libksba@1.5.1-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libgcrypt@1.10.0-11.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/dnf-data@4.14.0-25.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/openldap@2.6.8-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsemanage@3.6-5.el9_6" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gawk@5.1.0-6.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsmartcols@2.37.4-21.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/librepo@1.14.5-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libxml2@2.9.13-12.el9_6" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/readline@8.1-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/lua-libs@5.4.4-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/sqlite-libs@3.34.1-8.el9_6" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/cyrus-sasl-lib@2.1.27-21.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/lz4-libs@1.9.3-5.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/pcre@8.44-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gmp@6.2.0-13.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/tzdata@2025b-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gpg-pubkey@5a6340b3-6229229e" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/dejavu-sans-fonts@2.37-18.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libmodulemd@2.13.0-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/filesystem@3.16-5.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/sed@4.8-9.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/pcre2@10.40-6.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/openssl-libs@3.2.2-6.el9_5.1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsolv@0.7.24-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libattr@2.5.1-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsepol@3.6-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/json-glib@1.6.6-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libblkid@2.37.4-21.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gobject-introspection@1.68.0-11.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcurl-minimal@7.76.1-31.el9_6.1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/rpm-libs@4.16.1.3-37.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gpg-pubkey@fd431d51-4ae0493b" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/fonts-filesystem@2.0.5-7.el9.1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/nettle@3.10.1-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/langpacks-core-en@3.0-16.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libreport-filesystem@2.15.2-6.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/bash@5.1.8-9.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/langpacks-core-font-en@3.0-16.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/zlib@1.2.11-40.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libverto@0.3.2-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/shadow-utils@4.9-12.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glibc@2.34-168.el9_6.23" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libnghttp2@1.43.0-6.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/curl-minimal@7.76.1-31.el9_6.1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gnupg2@2.3.3-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/npth@1.6-8.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/coreutils-single@8.32-39.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcom_err@1.46.5-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/alternatives@1.24-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gdbm-libs@1.23-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/ncurses-libs@6.2-10.20210508.el9_6.2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libassuan@2.5.5-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/redhat-release@9.6-0.1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libuuid@2.37.4-21.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gpgme@1.15.1-6.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/crypto-policies@20250128-1.git5269e22.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libtasn1@4.16.0-9.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/rpm@4.16.1.3-37.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/systemd-libs@252-51.el9_6.2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libxcrypt@4.4.18-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libtool-ltdl@2.4.6-46.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/librhsm@0.0.3-9.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libevent@2.1.12-8.el9_4" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glibc-minimal-langpack@2.34-168.el9_6.23" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/ncurses-base@6.2-10.20210508.el9_6.2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/mpfr@4.1.0-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libffi@3.4.2-8.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/keyutils-libs@1.6.3-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/rootfiles@8.1-34.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libacl@2.3.1-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libyaml@0.2.5-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-6.el9_5" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/popt@1.18-8.el9" : {
        "evidence" : [ ]
      },
      "pkg:oci/ubi-minimal@sha256%3A34880b64c07f28f64d95737f82f891516de9a3b43583f39970f7bf8e4cfa48b7" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/bzip2-libs@1.0.8-10.el9_5" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/file-libs@5.39-16.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gnutls@3.8.3-6.el9_6.2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/langpacks-en@3.0-16.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libstdc%2B%2B@11.5.0-5.el9_5" : {
        "evidence" : [ ]
      }
    }
  } ]
}