Inspecting raw image manifest quay.io/redhat-appstudio-qe/build-e2e-dzwl/gl-multi-component-child-awav@sha256:a77d4eb11681f691f6fc408f054688be58d28cd3fbf565b40f52be3aa3769862.
Selecting auth
Using token for quay.io/redhat-appstudio-qe/build-e2e-dzwl/gl-multi-component-child-awav
Selecting auth
Using token for quay.io/redhat-appstudio-qe/build-e2e-dzwl/gl-multi-component-child-awav
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Downloading SBOMs this way does not ensure its authenticity. If you want to ensure a tamper-proof SBOM, download it using 'cosign download attestation <image uri>'.
Found SBOM of media type: text/spdx+json
Running TPA scan on amd64 image manifest...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100  229k    0     0  100  229k      0  1057k --:--:-- --:--:-- --:--:-- 1052k
100  229k    0     0  100  229k      0   188k  0:00:01  0:00:01 --:--:--  188k
100  229k    0     0  100  229k      0   103k  0:00:02  0:00:02 --:--:--  103k
100  229k    0     0  100  229k      0  73011  0:00:03  0:00:03 --:--:-- 72988
100  229k    0     0  100  229k      0  55692  0:00:04  0:00:04 --:--:-- 55679
100  229k    0     0  100  229k      0  45015  0:00:05  0:00:05 --:--:--     0
100  229k    0     0  100  229k      0  37773  0:00:06  0:00:06 --:--:--     0
100  229k    0     0  100  229k      0  32538  0:00:07  0:00:07 --:--:--     0
100  229k    0     0  100  229k      0  28577  0:00:08  0:00:08 --:--:--     0
100  229k    0     0  100  229k      0  25476  0:00:09  0:00:09 --:--:--     0
100  229k    0     0  100  229k      0  22982  0:00:10  0:00:10 --:--:--     0
100  229k    0     0  100  229k      0  20933  0:00:11  0:00:11 --:--:--     0
100  229k    0     0  100  229k      0  19220  0:00:12  0:00:12 --:--:--     0
100  229k    0     0  100  229k      0  17765  0:00:13  0:00:13 --:--:--     0
100  229k    0     0  100  229k      0  16516  0:00:14  0:00:14 --:--:--     0
100  229k    0     0  100  229k      0  15430  0:00:15  0:00:15 --:--:--     0
100  229k    0     0  100  229k      0  14479  0:00:16  0:00:16 --:--:--     0
100  229k    0     0  100  229k      0  13638  0:00:17  0:00:17 --:--:--     0
100  229k    0     0  100  229k      0  12889  0:00:18  0:00:18 --:--:--     0
100  229k    0     0  100  229k      0  12218  0:00:19  0:00:19 --:--:--     0
100  229k    0     0  100  229k      0  11614  0:00:20  0:00:20 --:--:--     0
100  229k    0     0  100  229k      0  11066  0:00:21  0:00:21 --:--:--     0
100  229k    0     0  100  229k      0  10568  0:00:22  0:00:22 --:--:--     0
100  229k    0     0  100  229k      0  10113  0:00:23  0:00:23 --:--:--     0
100  229k    0     0  100  229k      0   9695  0:00:24  0:00:24 --:--:--     0
100  229k    0     0  100  229k      0   9311  0:00:25  0:00:25 --:--:--     0
100  229k    0     0  100  229k      0   8956  0:00:26  0:00:26 --:--:--     0
100  229k    0     0  100  229k      0   8626  0:00:27  0:00:27 --:--:--     0
100  229k    0     0  100  229k      0   8321  0:00:28  0:00:28 --:--:--     0
100  229k    0     0  100  229k      0   8036  0:00:29  0:00:29 --:--:--     0
100  229k    0     0  100  229k      0   7770  0:00:30  0:00:30 --:--:--     0
100  229k    0     0  100  229k      0   7521  0:00:31  0:00:31 --:--:--     0
100  229k    0     0  100  229k      0   7288  0:00:32  0:00:32 --:--:--     0
100  229k    0     0  100  229k      0   7068  0:00:33  0:00:33 --:--:--     0
100  229k    0     0  100  229k      0   6861  0:00:34  0:00:34 --:--:--     0
100  229k    0     0  100  229k      0   6667  0:00:35  0:00:35 --:--:--     0
100  229k    0     0  100  229k      0   6483  0:00:36  0:00:36 --:--:--     0
100  229k    0     0  100  229k      0   6308  0:00:37  0:00:37 --:--:--     0
100  229k    0     0  100  229k      0   6143  0:00:38  0:00:38 --:--:--     0
100  229k    0     0  100  229k      0   5987  0:00:39  0:00:39 --:--:--     0
100  229k    0     0  100  229k      0   5838  0:00:40  0:00:40 --:--:--     0
100  229k    0     0  100  229k      0   5696  0:00:41  0:00:41 --:--:--     0
100  229k    0     0  100  229k      0   5561  0:00:42  0:00:42 --:--:--     0
100  229k    0     0  100  229k      0   5432  0:00:43  0:00:43 --:--:--     0
100  229k    0     0  100  229k      0   5309  0:00:44  0:00:44 --:--:--     0
100  229k    0     0  100  229k      0   5192  0:00:45  0:00:45 --:--:--     0
100  229k    0     0  100  229k      0   5080  0:00:46  0:00:46 --:--:--     0
100  229k    0     0  100  229k      0   4972  0:00:47  0:00:47 --:--:--     0
100  229k    0     0  100  229k      0   4869  0:00:48  0:00:48 --:--:--     0
100  229k    0     0  100  229k      0   4770  0:00:49  0:00:49 --:--:--     0
100  229k    0     0  100  229k      0   4675  0:00:50  0:00:50 --:--:--     0
100  229k    0     0  100  229k      0   4584  0:00:51  0:00:51 --:--:--     0
100  229k    0     0  100  229k      0   4496  0:00:52  0:00:52 --:--:--     0
100  229k    0     0  100  229k      0   4412  0:00:53  0:00:53 --:--:--     0
100  229k    0     0  100  229k      0   4330  0:00:54  0:00:54 --:--:--     0
100  229k    0     0  100  229k      0   4252  0:00:55  0:00:55 --:--:--     0
100  229k    0     0  100  229k      0   4176  0:00:56  0:00:56 --:--:--     0
100  229k    0     0  100  229k      0   4103  0:00:57  0:00:57 --:--:--     0
100  229k    0     0  100  229k      0   4033  0:00:58  0:00:58 --:--:--     0
100  229k    0     0  100  229k      0   3964  0:00:59  0:00:59 --:--:--     0
100  229k    0     0  100  229k      0   3899  0:01:00  0:01:00 --:--:--     0
100  229k    0     0  100  229k      0   3835  0:01:01  0:01:01 --:--:--     0
100  229k    0     0  100  229k      0   3773  0:01:02  0:01:02 --:--:--     0
100  229k    0     0  100  229k      0   3714  0:01:03  0:01:03 --:--:--     0
100  229k    0     0  100  229k      0   3656  0:01:04  0:01:04 --:--:--     0
100  229k    0     0  100  229k      0   3600  0:01:05  0:01:05 --:--:--     0
100  229k    0     0  100  229k      0   3545  0:01:06  0:01:06 --:--:--     0
100  229k    0     0  100  229k      0   3493  0:01:07  0:01:07 --:--:--     0
100  229k    0     0  100  229k      0   3441  0:01:08  0:01:08 --:--:--     0
100  229k    0     0  100  229k      0   3392  0:01:09  0:01:09 --:--:--     0
100  229k    0     0  100  229k      0   3343  0:01:10  0:01:10 --:--:--     0
100  229k    0     0  100  229k      0   3296  0:01:11  0:01:11 --:--:--     0
100  229k    0     0  100  229k      0   3251  0:01:12  0:01:12 --:--:--     0
100  229k    0     0  100  229k      0   3206  0:01:13  0:01:13 --:--:--     0
100  229k    0     0  100  229k      0   3163  0:01:14  0:01:14 --:--:--     0
100  229k    0     0  100  229k      0   3121  0:01:15  0:01:15 --:--:--     0
100  229k    0     0  100  229k      0   3080  0:01:16  0:01:16 --:--:--     0
100  229k    0     0  100  229k      0   3040  0:01:17  0:01:17 --:--:--     0
100  229k    0     0  100  229k      0   3001  0:01:18  0:01:18 --:--:--     0
100  229k    0     0  100  229k      0   2963  0:01:19  0:01:19 --:--:--     0
100  229k    0     0  100  229k      0   2926  0:01:20  0:01:20 --:--:--     0
100  229k    0     0  100  229k      0   2890  0:01:21  0:01:21 --:--:--     0
100  229k    0     0  100  229k      0   2855  0:01:22  0:01:22 --:--:--     0
100  229k    0     0  100  229k      0   2821  0:01:23  0:01:23 --:--:--     0
100  229k    0     0  100  229k      0   2787  0:01:24  0:01:24 --:--:--     0
100  229k    0     0  100  229k      0   2755  0:01:25  0:01:25 --:--:--     0
100  229k    0     0  100  229k      0   2723  0:01:26  0:01:26 --:--:--     0
100  229k    0     0  100  229k      0   2692  0:01:27  0:01:27 --:--:--     0
100  229k    0     0  100  229k      0   2661  0:01:28  0:01:28 --:--:--     0
100  229k    0     0  100  229k      0   2631  0:01:29  0:01:29 --:--:--     0
100  229k    0     0  100  229k      0   2602  0:01:30  0:01:30 --:--:--     0
100  229k    0     0  100  229k      0   2573  0:01:31  0:01:31 --:--:--     0
100  229k    0     0  100  229k      0   2546  0:01:32  0:01:32 --:--:--     0
100  229k    0     0  100  229k      0   2518  0:01:33  0:01:33 --:--:--     0
100  229k    0     0  100  229k      0   2492  0:01:34  0:01:34 --:--:--     0
100  229k    0     0  100  229k      0   2465  0:01:35  0:01:35 --:--:--     0
100  229k    0     0  100  229k      0   2440  0:01:36  0:01:36 --:--:--     0
100  229k    0     0  100  229k      0   2415  0:01:37  0:01:37 --:--:--     0
100  229k    0     0  100  229k      0   2390  0:01:38  0:01:38 --:--:--     0
100  229k    0     0  100  229k      0   2366  0:01:39  0:01:39 --:--:--     0
100  229k    0     0  100  229k      0   2342  0:01:40  0:01:40 --:--:--     0
100  229k    0     0  100  229k      0   2319  0:01:41  0:01:41 --:--:--     0
100  229k    0     0  100  229k      0   2296  0:01:42  0:01:42 --:--:--     0
100  229k    0     0  100  229k      0   2274  0:01:43  0:01:43 --:--:--     0
100  229k    0     0  100  229k      0   2252  0:01:44  0:01:44 --:--:--     0
100  229k    0     0  100  229k      0   2231  0:01:45  0:01:45 --:--:--     0
100  229k    0     0  100  229k      0   2210  0:01:46  0:01:46 --:--:--     0
100  229k    0     0  100  229k      0   2189  0:01:47  0:01:47 --:--:--     0
100  229k    0     0  100  229k      0   2169  0:01:48  0:01:48 --:--:--     0
100  229k    0     0  100  229k      0   2149  0:01:49  0:01:49 --:--:--     0
100  229k    0     0  100  229k      0   2130  0:01:50  0:01:50 --:--:--     0
100  229k    0     0  100  229k      0   2111  0:01:51  0:01:51 --:--:--     0
100  229k    0     0  100  229k      0   2092  0:01:52  0:01:52 --:--:--     0
100  229k    0     0  100  229k      0   2073  0:01:53  0:01:53 --:--:--     0
100  229k    0     0  100  229k      0   2055  0:01:54  0:01:54 --:--:--     0
100  229k    0     0  100  229k      0   2037  0:01:55  0:01:55 --:--:--     0
100  229k    0     0  100  229k      0   2020  0:01:56  0:01:56 --:--:--     0
100  229k    0     0  100  229k      0   2003  0:01:57  0:01:57 --:--:--     0
100  229k    0     0  100  229k      0   1986  0:01:58  0:01:58 --:--:--     0
100  229k    0     0  100  229k      0   1969  0:01:59  0:01:59 --:--:--     0
100  229k    0     0  100  229k      0   1953  0:02:00  0:02:00 --:--:--     0
100  229k    0     0  100  229k      0   1936  0:02:01  0:02:01 --:--:--     0
100  229k    0     0  100  229k      0   1921  0:02:02  0:02:02 --:--:--     0
100  229k    0     0  100  229k      0   1905  0:02:03  0:02:03 --:--:--     0
100  229k    0     0  100  229k      0   1890  0:02:04  0:02:04 --:--:--     0
100  229k    0     0  100  229k      0   1875  0:02:05  0:02:05 --:--:--     0
100  229k    0     0  100  229k      0   1860  0:02:06  0:02:06 --:--:--     0
100  229k    0     0  100  229k      0   1845  0:02:07  0:02:07 --:--:--     0
100  229k    0     0  100  229k      0   1831  0:02:08  0:02:08 --:--:--     0
100  229k    0     0  100  229k      0   1817  0:02:09  0:02:09 --:--:--     0
100  229k    0     0  100  229k      0   1803  0:02:10  0:02:10 --:--:--     0
100  229k    0     0  100  229k      0   1789  0:02:11  0:02:11 --:--:--     0
100  229k    0     0  100  229k      0   1775  0:02:12  0:02:12 --:--:--     0
100  229k    0     0  100  229k      0   1762  0:02:13  0:02:13 --:--:--     0
100  229k    0     0  100  229k      0   1749  0:02:14  0:02:14 --:--:--     0
100  229k    0     0  100  229k      0   1736  0:02:15  0:02:15 --:--:--     0
100  229k    0     0  100  229k      0   1723  0:02:16  0:02:16 --:--:--     0
100  229k    0     0  100  229k      0   1711  0:02:17  0:02:17 --:--:--     0
100  229k    0     0  100  229k      0   1698  0:02:18  0:02:18 --:--:--     0
100  229k    0     0  100  229k      0   1686  0:02:19  0:02:19 --:--:--     0
100  229k    0     0  100  229k      0   1674  0:02:20  0:02:20 --:--:--     0
100  229k    0     0  100  229k      0   1662  0:02:21  0:02:21 --:--:--     0
100  229k    0     0  100  229k      0   1650  0:02:22  0:02:22 --:--:--     0
100  229k    0     0  100  229k      0   1639  0:02:23  0:02:23 --:--:--     0
100  229k    0     0  100  229k      0   1628  0:02:24  0:02:24 --:--:--     0
100  229k    0     0  100  229k      0   1616  0:02:25  0:02:25 --:--:--     0
100  229k    0     0  100  229k      0   1605  0:02:26  0:02:26 --:--:--     0
100  229k    0     0  100  229k      0   1594  0:02:27  0:02:27 --:--:--     0
100  229k    0     0  100  229k      0   1584  0:02:28  0:02:28 --:--:--     0
100  229k    0     0  100  229k      0   1573  0:02:29  0:02:29 --:--:--     0
100  229k    0     0  100  229k      0   1556  0:02:31  0:02:31 --:--:--     0
100  229k    0     0  100  229k      0   1546  0:02:32  0:02:32 --:--:--     0
100  229k    0     0  100  229k      0   1535  0:02:33  0:02:33 --:--:--     0
100  229k    0     0  100  229k      0   1526  0:02:34  0:02:34 --:--:--     0
100  229k    0     0  100  229k      0   1516  0:02:35  0:02:35 --:--:--     0
100  229k    0     0  100  229k      0   1506  0:02:36  0:02:36 --:--:--     0
100  229k    0     0  100  229k      0   1496  0:02:37  0:02:37 --:--:--     0
100  229k    0     0  100  229k      0   1487  0:02:38  0:02:38 --:--:--     0
100  229k    0     0  100  229k      0   1477  0:02:39  0:02:39 --:--:--     0
100  229k    0     0  100  229k      0   1468  0:02:40  0:02:40 --:--:--     0
100  229k    0     0  100  229k      0   1459  0:02:41  0:02:41 --:--:--     0
100  229k    0     0  100  229k      0   1450  0:02:42  0:02:42 --:--:--     0
100  229k    0     0  100  229k      0   1441  0:02:43  0:02:43 --:--:--     0
100  229k    0     0  100  229k      0   1432  0:02:44  0:02:44 --:--:--     0
100  229k    0     0  100  229k      0   1424  0:02:45  0:02:45 --:--:--     0
100  229k    0     0  100  229k      0   1415  0:02:46  0:02:46 --:--:--     0
100  229k    0     0  100  229k      0   1407  0:02:47  0:02:47 --:--:--     0
100  229k    0     0  100  229k      0   1398  0:02:48  0:02:48 --:--:--     0
100  229k    0     0  100  229k      0   1390  0:02:49  0:02:49 --:--:--     0
100  229k    0     0  100  229k      0   1382  0:02:50  0:02:50 --:--:--     0
100  229k    0     0  100  229k      0   1374  0:02:51  0:02:51 --:--:--     0
100  229k    0     0  100  229k      0   1366  0:02:52  0:02:52 --:--:--     0
100  229k    0     0  100  229k      0   1358  0:02:53  0:02:53 --:--:--     0
100  229k    0     0  100  229k      0   1350  0:02:54  0:02:54 --:--:--     0
100  229k    0     0  100  229k      0   1342  0:02:55  0:02:55 --:--:--     0
100  229k    0     0  100  229k      0   1335  0:02:56  0:02:56 --:--:--     0
100  229k    0     0  100  229k      0   1327  0:02:57  0:02:57 --:--:--     0
100  229k    0     0  100  229k      0   1320  0:02:58  0:02:58 --:--:--     0
100  229k    0     0  100  229k      0   1312  0:02:59  0:02:59 --:--:--     0
 99  229k    0     0  100  229k      0   1305  0:03:00  0:03:00 --:--:--     0
curl: (22) The requested URL returned error: 504
info: Retrying again in 5 seconds...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100  229k    0     0  100  229k      0  1103k --:--:-- --:--:-- --:--:-- 1098k
100  229k    0     0  100  229k      0   189k  0:00:01  0:00:01 --:--:--  189k
100  229k    0     0  100  229k      0   103k  0:00:02  0:00:02 --:--:--  103k
100  229k    0     0  100  229k      0  73193  0:00:03  0:00:03 --:--:-- 73193
100  229k    0     0  100  229k      0  55798  0:00:04  0:00:04 --:--:-- 55785
100  229k    0     0  100  229k      0  45084  0:00:05  0:00:05 --:--:--     0
100  229k    0     0  100  229k      0  37821  0:00:06  0:00:06 --:--:--     0
100  229k    0     0  100  229k      0  32574  0:00:07  0:00:07 --:--:--     0
100  229k    0     0  100  229k      0  28605  0:00:08  0:00:08 --:--:--     0
100  229k    0     0  100  229k      0  25498  0:00:09  0:00:09 --:--:--     0
100  229k    0     0  100  229k      0  23000  0:00:10  0:00:10 --:--:--     0
100  229k    0     0  100  229k      0  20948  0:00:11  0:00:11 --:--:--     0
100  229k    0     0  100  229k      0  19232  0:00:12  0:00:12 --:--:--     0
100  229k    0     0  100  229k      0  17776  0:00:13  0:00:13 --:--:--     0
100  229k    0     0  100  229k      0  16525  0:00:14  0:00:14 --:--:--     0
100  229k    0     0  100  229k      0  15438  0:00:15  0:00:15 --:--:--     0
100  229k    0     0  100  229k      0  14486  0:00:16  0:00:16 --:--:--     0
100  229k    0     0  100  229k      0  13644  0:00:17  0:00:17 --:--:--     0
100  229k    0     0  100  229k      0  12894  0:00:18  0:00:18 --:--:--     0
100  229k    0     0  100  229k      0  12223  0:00:19  0:00:19 --:--:--     0
100  229k    0     0  100  229k      0  11618  0:00:20  0:00:20 --:--:--     0
100  229k    0     0  100  229k      0  11070  0:00:21  0:00:21 --:--:--     0
100  229k    0     0  100  229k      0  10572  0:00:22  0:00:22 --:--:--     0
100  229k    0     0  100  229k      0  10116  0:00:23  0:00:23 --:--:--     0
100  229k    0     0  100  229k      0   9698  0:00:24  0:00:24 --:--:--     0
100  229k    0     0  100  229k      0   9314  0:00:25  0:00:25 --:--:--     0
100  229k    0     0  100  229k      0   8959  0:00:26  0:00:26 --:--:--     0
100  229k    0     0  100  229k      0   8629  0:00:27  0:00:27 --:--:--     0
100  229k    0     0  100  229k      0   8323  0:00:28  0:00:28 --:--:--     0
100  229k    0     0  100  229k      0   8038  0:00:29  0:00:29 --:--:--     0
100  229k    0     0  100  229k      0   7772  0:00:30  0:00:30 --:--:--     0
100  229k    0     0  100  229k      0   7523  0:00:31  0:00:31 --:--:--     0
100  229k    0     0  100  229k      0   7290  0:00:32  0:00:32 --:--:--     0
100  229k    0     0  100  229k      0   7070  0:00:33  0:00:33 --:--:--     0
100  229k    0     0  100  229k      0   6863  0:00:34  0:00:34 --:--:--     0
100  229k    0     0  100  229k      0   6668  0:00:35  0:00:35 --:--:--     0
100  229k    0     0  100  229k      0   6484  0:00:36  0:00:36 --:--:--     0
100  229k    0     0  100  229k      0   6310  0:00:37  0:00:37 --:--:--     0
100  229k    0     0  100  229k      0   6145  0:00:38  0:00:38 --:--:--     0
100  229k    0     0  100  229k      0   5988  0:00:39  0:00:39 --:--:--     0
100  229k    0     0  100  229k      0   5839  0:00:40  0:00:40 --:--:--     0
100  229k    0     0  100  229k      0   5697  0:00:41  0:00:41 --:--:--     0
100  229k    0     0  100  229k      0   5562  0:00:42  0:00:42 --:--:--     0
100  229k    0     0  100  229k      0   5434  0:00:43  0:00:43 --:--:--     0
100  229k    0     0  100  229k      0   5311  0:00:44  0:00:44 --:--:--     0
100  229k    0     0  100  229k      0   5193  0:00:45  0:00:45 --:--:--     0
100  229k    0     0  100  229k      0   5081  0:00:46  0:00:46 --:--:--     0
100  229k    0     0  100  229k      0   4973  0:00:47  0:00:47 --:--:--     0
100  229k    0     0  100  229k      0   4870  0:00:48  0:00:48 --:--:--     0
100  229k    0     0  100  229k      0   4771  0:00:49  0:00:49 --:--:--     0
100  229k    0     0  100  229k      0   4676  0:00:50  0:00:50 --:--:--     0
100  229k    0     0  100  229k      0   4585  0:00:51  0:00:51 --:--:--     0
100  229k    0     0  100  229k      0   4497  0:00:52  0:00:52 --:--:--     0
100  229k    0     0  100  229k      0   4412  0:00:53  0:00:53 --:--:--     0
100  229k    0     0  100  229k      0   4331  0:00:54  0:00:54 --:--:--     0
100  229k    0     0  100  229k      0   4252  0:00:55  0:00:55 --:--:--     0
100  229k    0     0  100  229k      0   4177  0:00:56  0:00:56 --:--:--     0
100  229k    0     0  100  229k      0   4104  0:00:57  0:00:57 --:--:--     0
100  229k    0     0  100  229k      0   4033  0:00:58  0:00:58 --:--:--     0
100  229k    0     0  100  229k      0   3965  0:00:59  0:00:59 --:--:--     0
100  229k    0     0  100  229k      0   3899  0:01:00  0:01:00 --:--:--     0
100  229k    0     0  100  229k      0   3835  0:01:01  0:01:01 --:--:--     0
100  229k    0     0  100  229k      0   3774  0:01:02  0:01:02 --:--:--     0
100  229k    0     0  100  229k      0   3714  0:01:03  0:01:03 --:--:--     0
100  229k    0     0  100  229k      0   3656  0:01:04  0:01:04 --:--:--     0
100  229k    0     0  100  229k      0   3600  0:01:05  0:01:05 --:--:--     0
100  229k    0     0  100  229k      0   3546  0:01:06  0:01:06 --:--:--     0
100  229k    0     0  100  229k      0   3493  0:01:07  0:01:07 --:--:--     0
100  229k    0     0  100  229k      0   3442  0:01:08  0:01:08 --:--:--     0
100  229k    0     0  100  229k      0   3392  0:01:09  0:01:09 --:--:--     0
100  229k    0     0  100  229k      0   3344  0:01:10  0:01:10 --:--:--     0
100  229k    0     0  100  229k      0   3297  0:01:11  0:01:11 --:--:--     0
100  229k    0     0  100  229k      0   3251  0:01:12  0:01:12 --:--:--     0
100  229k    0     0  100  229k      0   3207  0:01:13  0:01:13 --:--:--     0
100  229k    0     0  100  229k      0   3163  0:01:14  0:01:14 --:--:--     0
100  229k    0     0  100  229k      0   3121  0:01:15  0:01:15 --:--:--     0
100  229k    0     0  100  229k      0   3080  0:01:16  0:01:16 --:--:--     0
100  229k    0     0  100  229k      0   3041  0:01:17  0:01:17 --:--:--     0
100  229k    0     0  100  229k      0   3002  0:01:18  0:01:18 --:--:--     0
100  229k    0     0  100  229k      0   2964  0:01:19  0:01:19 --:--:--     0
100  229k    0     0  100  229k      0   2927  0:01:20  0:01:20 --:--:--     0
100  229k    0     0  100  229k      0   2891  0:01:21  0:01:21 --:--:--     0
100  229k    0     0  100  229k      0   2856  0:01:22  0:01:22 --:--:--     0
100  229k    0     0  100  229k      0   2821  0:01:23  0:01:23 --:--:--     0
100  229k    0     0  100  229k      0   2788  0:01:24  0:01:24 --:--:--     0
100  229k    0     0  100  229k      0   2755  0:01:25  0:01:25 --:--:--     0
100  229k    0     0  100  229k      0   2723  0:01:26  0:01:26 --:--:--     0
100  229k    0     0  100  229k      0   2692  0:01:27  0:01:27 --:--:--     0
100  229k    0     0  100  229k      0   2661  0:01:28  0:01:28 --:--:--     0
100  229k    0     0  100  229k      0   2631  0:01:29  0:01:29 --:--:--     0
100  229k    0     0  100  229k      0   2602  0:01:30  0:01:30 --:--:--     0
100  229k    0     0  100  229k      0   2574  0:01:31  0:01:31 --:--:--     0
100  229k    0     0  100  229k      0   2546  0:01:32  0:01:32 --:--:--     0
100  229k    0     0  100  229k      0   2518  0:01:33  0:01:33 --:--:--     0
100  229k    0     0  100  229k      0   2492  0:01:34  0:01:34 --:--:--     0
100  229k    0     0  100  229k      0   2466  0:01:35  0:01:35 --:--:--     0
100  229k    0     0  100  229k      0   2440  0:01:36  0:01:36 --:--:--     0
100  229k    0     0  100  229k      0   2415  0:01:37  0:01:37 --:--:--     0
100  229k    0     0  100  229k      0   2390  0:01:38  0:01:38 --:--:--     0
100  229k    0     0  100  229k      0   2366  0:01:39  0:01:39 --:--:--     0
100  229k    0     0  100  229k      0   2343  0:01:40  0:01:40 --:--:--     0
100  229k    0     0  100  229k      0   2319  0:01:41  0:01:41 --:--:--     0
100  229k    0     0  100  229k      0   2297  0:01:42  0:01:42 --:--:--     0
100  229k    0     0  100  229k      0   2274  0:01:43  0:01:43 --:--:--     0
100  229k    0     0  100  229k      0   2253  0:01:44  0:01:44 --:--:--     0
100  229k    0     0  100  229k      0   2231  0:01:45  0:01:45 --:--:--     0
100  229k    0     0  100  229k      0   2210  0:01:46  0:01:46 --:--:--     0
100  229k    0     0  100  229k      0   2189  0:01:47  0:01:47 --:--:--     0
100  229k    0     0  100  229k      0   2169  0:01:48  0:01:48 --:--:--     0
100  229k    0     0  100  229k      0   2149  0:01:49  0:01:49 --:--:--     0
100  229k    0     0  100  229k      0   2130  0:01:50  0:01:50 --:--:--     0
100  229k    0     0  100  229k      0   2111  0:01:51  0:01:51 --:--:--     0
100  229k    0     0  100  229k      0   2092  0:01:52  0:01:52 --:--:--     0
100  229k    0     0  100  229k      0   2073  0:01:53  0:01:53 --:--:--     0
100  229k    0     0  100  229k      0   2055  0:01:54  0:01:54 --:--:--     0
100  229k    0     0  100  229k      0   2037  0:01:55  0:01:55 --:--:--     0
100  229k    0     0  100  229k      0   2020  0:01:56  0:01:56 --:--:--     0
100  229k    0     0  100  229k      0   2003  0:01:57  0:01:57 --:--:--     0
100  229k    0     0  100  229k      0   1986  0:01:58  0:01:58 --:--:--     0
100  229k    0     0  100  229k      0   1969  0:01:59  0:01:59 --:--:--     0
100  229k    0     0  100  229k      0   1953  0:02:00  0:02:00 --:--:--     0
100  229k    0     0  100  229k      0   1937  0:02:01  0:02:01 --:--:--     0
100  229k    0     0  100  229k      0   1921  0:02:02  0:02:02 --:--:--     0
100  229k    0     0  100  229k      0   1905  0:02:03  0:02:03 --:--:--     0
100  229k    0     0  100  229k      0   1890  0:02:04  0:02:04 --:--:--     0
100  229k    0     0  100  229k      0   1875  0:02:05  0:02:05 --:--:--     0
100  229k    0     0  100  229k      0   1860  0:02:06  0:02:06 --:--:--     0
100  229k    0     0  100  229k      0   1845  0:02:07  0:02:07 --:--:--     0
100  229k    0     0  100  229k      0   1831  0:02:08  0:02:08 --:--:--     0
100  229k    0     0  100  229k      0   1817  0:02:09  0:02:09 --:--:--     0
100  229k    0     0  100  229k      0   1803  0:02:10  0:02:10 --:--:--     0
100  229k    0     0  100  229k      0   1789  0:02:11  0:02:11 --:--:--     0
100  229k    0     0  100  229k      0   1775  0:02:12  0:02:12 --:--:--     0
100  229k    0     0  100  229k      0   1762  0:02:13  0:02:13 --:--:--     0
100  229k    0     0  100  229k      0   1749  0:02:14  0:02:14 --:--:--     0
100  229k    0     0  100  229k      0   1736  0:02:15  0:02:15 --:--:--     0
100  229k    0     0  100  229k      0   1723  0:02:16  0:02:16 --:--:--     0
100  229k    0     0  100  229k      0   1711  0:02:17  0:02:17 --:--:--     0
100  229k    0     0  100  229k      0   1698  0:02:18  0:02:18 --:--:--     0
100  229k    0     0  100  229k      0   1686  0:02:19  0:02:19 --:--:--     0
100  229k    0     0  100  229k      0   1674  0:02:20  0:02:20 --:--:--     0
100  229k    0     0  100  229k      0   1662  0:02:21  0:02:21 --:--:--     0
100  229k    0     0  100  229k      0   1650  0:02:22  0:02:22 --:--:--     0
100  229k    0     0  100  229k      0   1639  0:02:23  0:02:23 --:--:--     0
100  229k    0     0  100  229k      0   1628  0:02:24  0:02:24 --:--:--     0
100  229k    0     0  100  229k      0   1616  0:02:25  0:02:25 --:--:--     0
100  229k    0     0  100  229k      0   1605  0:02:26  0:02:26 --:--:--     0
100  229k    0     0  100  229k      0   1594  0:02:27  0:02:27 --:--:--     0
100  229k    0     0  100  229k      0   1584  0:02:28  0:02:28 --:--:--     0
100  229k    0     0  100  229k      0   1573  0:02:29  0:02:29 --:--:--     0
100  229k    0     0  100  229k      0   1556  0:02:31  0:02:31 --:--:--     0
100  229k    0     0  100  229k      0   1546  0:02:32  0:02:32 --:--:--     0
100  229k    0     0  100  229k      0   1536  0:02:33  0:02:33 --:--:--     0
100  229k    0     0  100  229k      0   1526  0:02:34  0:02:34 --:--:--     0
100  229k    0     0  100  229k      0   1516  0:02:35  0:02:35 --:--:--     0
100  229k    0     0  100  229k      0   1506  0:02:36  0:02:36 --:--:--     0
100  229k    0     0  100  229k      0   1496  0:02:37  0:02:37 --:--:--     0
100  229k    0     0  100  229k      0   1487  0:02:38  0:02:38 --:--:--     0
100  229k    0     0  100  229k      0   1477  0:02:39  0:02:39 --:--:--     0
100  229k    0     0  100  229k      0   1468  0:02:40  0:02:40 --:--:--     0
100  229k    0     0  100  229k      0   1459  0:02:41  0:02:41 --:--:--     0
100  229k    0     0  100  229k      0   1450  0:02:42  0:02:42 --:--:--     0
100  229k    0     0  100  229k      0   1441  0:02:43  0:02:43 --:--:--     0
100  229k    0     0  100  229k      0   1432  0:02:44  0:02:44 --:--:--     0
100  229k    0     0  100  229k      0   1424  0:02:45  0:02:45 --:--:--     0
100  229k    0     0  100  229k      0   1415  0:02:46  0:02:46 --:--:--     0
100  229k    0     0  100  229k      0   1407  0:02:47  0:02:47 --:--:--     0
100  229k    0     0  100  229k      0   1398  0:02:48  0:02:48 --:--:--     0
100  229k    0     0  100  229k      0   1390  0:02:49  0:02:49 --:--:--     0
100  229k    0     0  100  229k      0   1382  0:02:50  0:02:50 --:--:--     0
100  229k    0     0  100  229k      0   1374  0:02:51  0:02:51 --:--:--     0
100  229k    0     0  100  229k      0   1366  0:02:52  0:02:52 --:--:--     0
100  229k    0     0  100  229k      0   1358  0:02:53  0:02:53 --:--:--     0
100  229k    0     0  100  229k      0   1350  0:02:54  0:02:54 --:--:--     0
100  229k    0     0  100  229k      0   1342  0:02:55  0:02:55 --:--:--     0
100  229k    0     0  100  229k      0   1335  0:02:56  0:02:56 --:--:--     0
100  229k    0     0  100  229k      0   1327  0:02:57  0:02:57 --:--:--     0
100  229k    0     0  100  229k      0   1320  0:02:58  0:02:58 --:--:--     0
100  229k    0     0  100  229k      0   1312  0:02:59  0:02:59 --:--:--     0
 99  229k    0     0  100  229k      0   1305  0:03:00  0:03:00 --:--:--     0
curl: (22) The requested URL returned error: 504
info: Retrying again in 5 seconds...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
{
  "scanned" : {
    "total" : 122,
    "direct" : 23,
    "transitive" : 99
  },
  "providers" : {
    "rhtpa" : {
      "status" : {
        "ok" : false,
        "name" : "rhtpa",
        "code" : 504,
        "message" : "Request timed out",
        "warnings" : { }
      },
      "sources" : {
        "redhat-csaf" : {
          "summary" : {
            "direct" : 4,
            "transitive" : 8,
            "total" : 12,
            "dependencies" : 6,
            "critical" : 0,
            "high" : 1,
            "medium" : 6,
            "low" : 5,
            "unknown" : 0,
            "remediations" : 12,
            "recommendations" : 0,
            "unscanned" : 0
          },
          "dependencies" : [ {
            "ref" : "pkg:rpm/redhat/microdnf@3.9.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=microdnf-3.9.1-3.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-34743",
                "title" : "XZ Utils: Buffer overflow in lzma_index_append()",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-34743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_2.1", "5.8.3-1.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:7647",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_7647"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.8.3-1.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-34743",
                      "title" : "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
                      "url" : "https://www.redhat.com/#CVE-2026-34743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:64787",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_64787"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/sed@4.8-9.el9?arch=x86_64&distro=rhel-9.2&upstream=sed-4.8-9.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=rhel-9.2&upstream=gawk-5.1.0-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40468",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40468" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40468",
                      "title" : "gawk: gawk: Memory corruption via integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40468"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40467",
                "title" : "Use after free in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40467" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40467",
                      "title" : "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c",
                      "url" : "https://www.redhat.com/#CVE-2026-40467"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40469",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 2.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-40469" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40469",
                      "title" : "gawk: gawk: Denial of Service due to integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40469"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libidn2@2.3.0-7.el9?arch=x86_64&distro=rhel-9.2&upstream=libidn2-2.3.0-7.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/popt@1.18-8.el9?arch=x86_64&distro=rhel-9.2&upstream=popt-1.18-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-18739",
                "title" : "Popt-devel: popt-static: off-by-one in poptstuffargs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18739" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18739",
                      "title" : "popt-devel: popt-static: Off-by-one in poptStuffArgs",
                      "url" : "https://www.redhat.com/#CVE-2026-18739"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-18743",
                "title" : "Popt-devel: popt-static: short realloc in poptconfigfiletostring",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18743",
                      "title" : "popt-devel: popt-static: Short realloc in poptConfigFileToString",
                      "url" : "https://www.redhat.com/#CVE-2026-18743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-18839",
                "title" : "Popt-devel: popt-static: size_t underflow in singleoptionhelp",
                "source" : "redhat-csaf",
                "cvssScore" : 2.2,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18839" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.2.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-18839",
                      "title" : "popt-devel: popt-static: size_t underflow in singleOptionHelp",
                      "url" : "https://www.redhat.com/#CVE-2026-18839"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.2.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.2.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:77932"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:77932",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_77932"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.2.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.2.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:77932"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-18739",
                "title" : "Popt-devel: popt-static: off-by-one in poptstuffargs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18739" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18739",
                      "title" : "popt-devel: popt-static: Off-by-one in poptStuffArgs",
                      "url" : "https://www.redhat.com/#CVE-2026-18739"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-31115",
              "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
              "source" : "redhat-csaf",
              "cvssScore" : 7.5,
              "severity" : "HIGH",
              "cves" : [ "CVE-2025-31115" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.6.2-4.el10_0" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2025-31115",
                    "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                    "url" : "https://www.redhat.com/#CVE-2025-31115"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2025:7524",
                    "title" : "Red Hat Security Advisory: xz security update",
                    "url" : "https://www.redhat.com/#RHSA-2025_7524"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/systemd-libs@252-14.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=systemd-252-14.el9_2.1.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-34743",
                "title" : "XZ Utils: Buffer overflow in lzma_index_append()",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-34743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_2.1", "5.8.3-1.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:7647",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_7647"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.8.3-1.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-34743",
                      "title" : "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
                      "url" : "https://www.redhat.com/#CVE-2026-34743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:64787",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_64787"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/sed@4.8-9.el9?arch=x86_64&distro=rhel-9.2&upstream=sed-4.8-9.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-31115",
              "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
              "source" : "redhat-csaf",
              "cvssScore" : 7.5,
              "severity" : "HIGH",
              "cves" : [ "CVE-2025-31115" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.6.2-4.el10_0" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2025-31115",
                    "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                    "url" : "https://www.redhat.com/#CVE-2025-31115"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2025:7524",
                    "title" : "Red Hat Security Advisory: xz security update",
                    "url" : "https://www.redhat.com/#RHSA-2025_7524"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/libmodulemd@2.13.0-2.el9?arch=x86_64&distro=rhel-9.2&upstream=libmodulemd-2.13.0-2.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-34743",
                "title" : "XZ Utils: Buffer overflow in lzma_index_append()",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-34743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_2.1", "5.8.3-1.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:7647",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_7647"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.8.3-1.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-34743",
                      "title" : "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
                      "url" : "https://www.redhat.com/#CVE-2026-34743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:64787",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_64787"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/sed@4.8-9.el9?arch=x86_64&distro=rhel-9.2&upstream=sed-4.8-9.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=rhel-9.2&upstream=gawk-5.1.0-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40468",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40468" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40468",
                      "title" : "gawk: gawk: Memory corruption via integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40468"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40467",
                "title" : "Use after free in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40467" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40467",
                      "title" : "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c",
                      "url" : "https://www.redhat.com/#CVE-2026-40467"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40469",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 2.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-40469" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40469",
                      "title" : "gawk: gawk: Denial of Service due to integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40469"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libidn2@2.3.0-7.el9?arch=x86_64&distro=rhel-9.2&upstream=libidn2-2.3.0-7.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/popt@1.18-8.el9?arch=x86_64&distro=rhel-9.2&upstream=popt-1.18-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-18739",
                "title" : "Popt-devel: popt-static: off-by-one in poptstuffargs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18739" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18739",
                      "title" : "popt-devel: popt-static: Off-by-one in poptStuffArgs",
                      "url" : "https://www.redhat.com/#CVE-2026-18739"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-18743",
                "title" : "Popt-devel: popt-static: short realloc in poptconfigfiletostring",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18743",
                      "title" : "popt-devel: popt-static: Short realloc in poptConfigFileToString",
                      "url" : "https://www.redhat.com/#CVE-2026-18743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-18839",
                "title" : "Popt-devel: popt-static: size_t underflow in singleoptionhelp",
                "source" : "redhat-csaf",
                "cvssScore" : 2.2,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18839" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.2.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-18839",
                      "title" : "popt-devel: popt-static: size_t underflow in singleOptionHelp",
                      "url" : "https://www.redhat.com/#CVE-2026-18839"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.2.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.2.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:77932"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:77932",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_77932"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.2.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.2.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:77932"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-18739",
                "title" : "Popt-devel: popt-static: off-by-one in poptstuffargs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18739" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18739",
                      "title" : "popt-devel: popt-static: Off-by-one in poptStuffArgs",
                      "url" : "https://www.redhat.com/#CVE-2026-18739"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-31115",
              "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
              "source" : "redhat-csaf",
              "cvssScore" : 7.5,
              "severity" : "HIGH",
              "cves" : [ "CVE-2025-31115" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.6.2-4.el10_0" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2025-31115",
                    "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                    "url" : "https://www.redhat.com/#CVE-2025-31115"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2025:7524",
                    "title" : "Red Hat Security Advisory: xz security update",
                    "url" : "https://www.redhat.com/#RHSA-2025_7524"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/libusbx@1.0.26-1.el9?arch=x86_64&distro=rhel-9.2&upstream=libusbx-1.0.26-1.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-34743",
                "title" : "XZ Utils: Buffer overflow in lzma_index_append()",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-34743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_2.1", "5.8.3-1.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:7647",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_7647"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.8.3-1.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-34743",
                      "title" : "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
                      "url" : "https://www.redhat.com/#CVE-2026-34743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:64787",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_64787"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/sed@4.8-9.el9?arch=x86_64&distro=rhel-9.2&upstream=sed-4.8-9.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-31115",
              "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
              "source" : "redhat-csaf",
              "cvssScore" : 7.5,
              "severity" : "HIGH",
              "cves" : [ "CVE-2025-31115" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.6.2-4.el10_0" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2025-31115",
                    "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                    "url" : "https://www.redhat.com/#CVE-2025-31115"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2025:7524",
                    "title" : "Red Hat Security Advisory: xz security update",
                    "url" : "https://www.redhat.com/#RHSA-2025_7524"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/rpm-libs@4.16.1.3-22.el9?arch=x86_64&distro=rhel-9.2&upstream=rpm-4.16.1.3-22.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-34743",
                "title" : "XZ Utils: Buffer overflow in lzma_index_append()",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-34743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_2.1", "5.8.3-1.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:7647",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_7647"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.8.3-1.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-34743",
                      "title" : "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
                      "url" : "https://www.redhat.com/#CVE-2026-34743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:64787",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_64787"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/sed@4.8-9.el9?arch=x86_64&distro=rhel-9.2&upstream=sed-4.8-9.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=rhel-9.2&upstream=gawk-5.1.0-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40468",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40468" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40468",
                      "title" : "gawk: gawk: Memory corruption via integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40468"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40467",
                "title" : "Use after free in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40467" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40467",
                      "title" : "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c",
                      "url" : "https://www.redhat.com/#CVE-2026-40467"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40469",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 2.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-40469" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40469",
                      "title" : "gawk: gawk: Denial of Service due to integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40469"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/popt@1.18-8.el9?arch=x86_64&distro=rhel-9.2&upstream=popt-1.18-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-18739",
                "title" : "Popt-devel: popt-static: off-by-one in poptstuffargs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18739" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18739",
                      "title" : "popt-devel: popt-static: Off-by-one in poptStuffArgs",
                      "url" : "https://www.redhat.com/#CVE-2026-18739"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-18743",
                "title" : "Popt-devel: popt-static: short realloc in poptconfigfiletostring",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18743",
                      "title" : "popt-devel: popt-static: Short realloc in poptConfigFileToString",
                      "url" : "https://www.redhat.com/#CVE-2026-18743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-18839",
                "title" : "Popt-devel: popt-static: size_t underflow in singleoptionhelp",
                "source" : "redhat-csaf",
                "cvssScore" : 2.2,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18839" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.2.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-18839",
                      "title" : "popt-devel: popt-static: size_t underflow in singleOptionHelp",
                      "url" : "https://www.redhat.com/#CVE-2026-18839"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.2.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.2.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:77932"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:77932",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_77932"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.2.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.2.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:77932"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-18739",
                "title" : "Popt-devel: popt-static: off-by-one in poptstuffargs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-18739" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "1.19-11.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:56984",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56984"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-18739",
                      "title" : "popt-devel: popt-static: Off-by-one in poptStuffArgs",
                      "url" : "https://www.redhat.com/#CVE-2026-18739"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "1.19-11.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "1.19-11.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56984"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-31115",
              "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
              "source" : "redhat-csaf",
              "cvssScore" : 7.5,
              "severity" : "HIGH",
              "cves" : [ "CVE-2025-31115" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.6.2-4.el10_0" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2025-31115",
                    "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                    "url" : "https://www.redhat.com/#CVE-2025-31115"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2025:7524",
                    "title" : "Red Hat Security Advisory: xz security update",
                    "url" : "https://www.redhat.com/#RHSA-2025_7524"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/librepo@1.14.5-1.el9?arch=x86_64&distro=rhel-9.2&upstream=librepo-1.14.5-1.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-34743",
                "title" : "XZ Utils: Buffer overflow in lzma_index_append()",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-34743" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_2.1", "5.8.3-1.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:7647",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_7647"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.8.3-1.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-34743",
                      "title" : "xz: XZ Utils: Denial of Service via buffer overflow in index decoding",
                      "url" : "https://www.redhat.com/#CVE-2026-34743"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.8.3-1.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:7647"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:64787",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_64787"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:64787"
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.6.2-4.el10_0" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2025-31115",
                      "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                      "url" : "https://www.redhat.com/#CVE-2025-31115"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2025:7524",
                      "title" : "Red Hat Security Advisory: xz security update",
                      "url" : "https://www.redhat.com/#RHSA-2025_7524"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.6.2-4.el10_0",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.6.2-4.el10_0",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/sed@4.8-9.el9?arch=x86_64&distro=rhel-9.2&upstream=sed-4.8-9.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=rhel-9.2&upstream=gawk-5.1.0-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40468",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40468" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40468",
                      "title" : "gawk: gawk: Memory corruption via integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40468"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40467",
                "title" : "Use after free in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40467" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40467",
                      "title" : "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c",
                      "url" : "https://www.redhat.com/#CVE-2026-40467"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40469",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 2.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-40469" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40469",
                      "title" : "gawk: gawk: Denial of Service due to integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40469"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libidn2@2.3.0-7.el9?arch=x86_64&distro=rhel-9.2&upstream=libidn2-2.3.0-7.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-31115",
              "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
              "source" : "redhat-csaf",
              "cvssScore" : 7.5,
              "severity" : "HIGH",
              "cves" : [ "CVE-2025-31115" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.6.2-4.el10_0" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2025-31115",
                    "title" : "xz: XZ has a heap-use-after-free bug in threaded .xz decoder",
                    "url" : "https://www.redhat.com/#CVE-2025-31115"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2025:7524",
                    "title" : "Red Hat Security Advisory: xz security update",
                    "url" : "https://www.redhat.com/#RHSA-2025_7524"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.6.2-4.el10_0",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.6.2-4.el10_0",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2025:7524"
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/json-glib@1.6.6-1.el9?arch=x86_64&distro=rhel-9.2&upstream=json-glib-1.6.6-1.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libidn2@2.3.0-7.el9?arch=x86_64&distro=rhel-9.2&upstream=libidn2-2.3.0-7.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-54371",
              "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
              "source" : "redhat-csaf",
              "cvssScore" : 6.3,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2026-54371" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-54371",
                    "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                    "url" : "https://www.redhat.com/#CVE-2026-54371"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el9_8",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el8_10",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el10_2",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el9_8",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:56133",
                    "title" : "Red Hat Security Advisory: attr security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_56133"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el8_10",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el8_10",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:59380",
                    "title" : "Red Hat Security Advisory: attr security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_59380"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el10_2",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el10_2",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:34889",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_34889"
                  },

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100  929k    0  699k  100  229k  2046k   671k --:--:-- --:--:-- --:--:-- 2709k
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-9.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-9.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:60226",
                    "title" : "Red Hat Security Advisory: attr security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_60226"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el9_8",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el9_8",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/glib2@2.68.4-6.el9?arch=x86_64&distro=rhel-9.2&upstream=glib2-2.68.4-6.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libidn2@2.3.0-7.el9?arch=x86_64&distro=rhel-9.2&upstream=libidn2-2.3.0-7.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-54371",
              "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
              "source" : "redhat-csaf",
              "cvssScore" : 6.3,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2026-54371" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-54371",
                    "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                    "url" : "https://www.redhat.com/#CVE-2026-54371"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el9_8",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el8_10",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el10_2",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el9_8",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:56133",
                    "title" : "Red Hat Security Advisory: attr security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_56133"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el8_10",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el8_10",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:59380",
                    "title" : "Red Hat Security Advisory: attr security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_59380"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el10_2",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el10_2",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:34889",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_34889"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-9.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-9.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:60226",
                    "title" : "Red Hat Security Advisory: attr security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_60226"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el9_8",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el9_8",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/openldap-compat@2.6.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=openldap-2.6.2-3.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/sed@4.8-9.el9?arch=x86_64&distro=rhel-9.2&upstream=sed-4.8-9.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=rhel-9.2&upstream=gawk-5.1.0-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40468",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40468" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40468",
                      "title" : "gawk: gawk: Memory corruption via integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40468"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40467",
                "title" : "Use after free in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40467" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40467",
                      "title" : "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c",
                      "url" : "https://www.redhat.com/#CVE-2026-40467"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40469",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 2.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-40469" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40469",
                      "title" : "gawk: gawk: Denial of Service due to integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40469"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-5958",
              "title" : "Race Condition in GNU Sed",
              "source" : "redhat-csaf",
              "cvssScore" : 6.3,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2026-5958" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "4.10-1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-5958",
                    "title" : "sed: GNU sed TOCTOU race condition",
                    "url" : "https://www.redhat.com/#CVE-2026-5958"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "4.10-1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "4.10-1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:10995",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                    "url" : "https://www.redhat.com/#RHSA-2026_10995"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "4.10-1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "4.10-1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/gnupg2@2.3.3-2.el9_0?arch=x86_64&distro=rhel-9.2&upstream=gnupg2-2.3.3-2.el9_0.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/sed@4.8-9.el9?arch=x86_64&distro=rhel-9.2&upstream=sed-4.8-9.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-5958",
                "title" : "Race Condition in GNU Sed",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5958" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "4.10-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-5958",
                      "title" : "sed: GNU sed TOCTOU race condition",
                      "url" : "https://www.redhat.com/#CVE-2026-5958"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:10995",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_10995"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "4.10-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "4.10-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=rhel-9.2&upstream=gawk-5.1.0-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40468",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40468" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40468",
                      "title" : "gawk: gawk: Memory corruption via integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40468"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40467",
                "title" : "Use after free in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40467" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40467",
                      "title" : "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c",
                      "url" : "https://www.redhat.com/#CVE-2026-40467"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    } ]
                  } ]
                }
              }, {
                "id" : "CVE-2026-40469",
                "title" : "Heap buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 2.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-40469" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40469",
                      "title" : "gawk: gawk: Denial of Service due to integer overflow",
                      "url" : "https://www.redhat.com/#CVE-2026-40469"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-40553",
                "title" : "Stack-based buffer overflow in gawk",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-40553" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:40041",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_40041"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.0-3.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:49661",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_49661"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.4.1-1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73429",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73429"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.3.0-6.el10_2.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:73512",
                      "title" : "Red Hat Security Advisory: gawk security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_73512"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-40553",
                      "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                      "url" : "https://www.redhat.com/#CVE-2026-40553"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.1.0-6.el9_8.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.3.0-6.el10_2.1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.1-1.hum1",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "5.4.0-3.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "5.1.0-6.el9_8.1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libidn2@2.3.0-7.el9?arch=x86_64&distro=rhel-9.2&upstream=libidn2-2.3.0-7.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-5958",
              "title" : "Race Condition in GNU Sed",
              "source" : "redhat-csaf",
              "cvssScore" : 6.3,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2026-5958" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "4.10-1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-5958",
                    "title" : "sed: GNU sed TOCTOU race condition",
                    "url" : "https://www.redhat.com/#CVE-2026-5958"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "4.10-1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "4.10-1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:10995",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                    "url" : "https://www.redhat.com/#RHSA-2026_10995"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "4.10-1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "4.10-1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:10995"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this vulnerability, avoid using the `sed -i --follow-symlinks` command in privileged contexts or on paths that can be influenced by untrusted users. This flaw specifically affects the `--follow-symlinks` option, which, when used by a privileged process on an attacker-controlled path, can lead to arbitrary file overwrite. Restricting the use of this specific option in sensitive operations can reduce the risk of exploitation."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/libpeas@1.30.0-4.el9?arch=x86_64&distro=rhel-9.2&upstream=libpeas-1.30.0-4.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-54371",
                "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-54371" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "CVE-2026-54371",
                      "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                      "url" : "https://www.redhat.com/#CVE-2026-54371"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    }, {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:56133",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_56133"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el8_10",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el8_10",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:59380",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_59380"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el10_2",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el10_2",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:34889",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                      "url" : "https://www.redhat.com/#RHSA-2026_34889"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-9.1.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-9.1.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "RHSA-2026:60226",
                      "title" : "Red Hat Security Advisory: attr security update",
                      "url" : "https://www.redhat.com/#RHSA-2026_60226"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.6.0-1.el9_8",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.6.0-1.el9_8",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                    } ]
                  } ]
                }
              }
            }, {
              "ref" : "pkg:rpm/redhat/libidn2@2.3.0-7.el9?arch=x86_64&distro=rhel-9.2&upstream=libidn2-2.3.0-7.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-57053",
                "title" : "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-57053" ],
                "unique" : false,
                "remediation" : {
                  "fixedIn" : [ "2.3.8-4.hum1" ],
                  "advisories" : [ {
                    "advisory" : {
                      "id" : "RHSA-2026:42125",
                      "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
                      "url" : "https://www.redhat.com/#RHSA-2026_42125"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  }, {
                    "advisory" : {
                      "id" : "CVE-2026-57053",
                      "title" : "libidn: GNU libidn: Out-of-bounds read in ToUnicode APIs",
                      "url" : "https://www.redhat.com/#CVE-2026-57053"
                    },
                    "status" : "affected",
                    "versionRanges" : [ {
                      "versionSchemeId" : "rpm",
                      "highVersion" : "2.3.8-4.hum1",
                      "highInclusive" : false
                    } ],
                    "fixedIn" : "2.3.8-4.hum1",
                    "remediations" : [ {
                      "category" : "VENDOR_FIX",
                      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                      "url" : "https://access.redhat.com/errata/RHSA-2026:42125"
                    }, {
                      "category" : "WORKAROUND",
                      "details" : "No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected."
                    } ]
                  } ]
                }
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2026-54371",
              "title" : "attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr",
              "source" : "redhat-csaf",
              "cvssScore" : 6.3,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2026-54371" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "2.6.0-1.el10_2", "2.6.0-1.el8_10", "2.6.0-1.el9_8", "2.6.0-9.1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "CVE-2026-54371",
                    "title" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
                    "url" : "https://www.redhat.com/#CVE-2026-54371"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el9_8",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el8_10",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el10_2",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el9_8",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:56133",
                    "title" : "Red Hat Security Advisory: attr security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_56133"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el8_10",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el8_10",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:56133"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:59380",
                    "title" : "Red Hat Security Advisory: attr security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_59380"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el10_2",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el10_2",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:59380"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:34889",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_34889"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-9.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-9.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:34889"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:60226",
                    "title" : "Red Hat Security Advisory: attr security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_60226"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "2.6.0-1.el9_8",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "2.6.0-1.el9_8",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:60226"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                } ]
              }
            }
          }, {
            "ref" : "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=rhel-9.2&upstream=gawk-5.1.0-6.el9.src.rpm",
            "issues" : [ {
              "id" : "CVE-2026-40553",
              "title" : "Stack-based buffer overflow in gawk",
              "source" : "redhat-csaf",
              "cvssScore" : 6.2,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2026-40553" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "RHSA-2026:40041",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_40041"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.0-3.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.0-3.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:49661",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_49661"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.1-1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.1-1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:73429",
                    "title" : "Red Hat Security Advisory: gawk security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_73429"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.3.0-6.el10_2.1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.3.0-6.el10_2.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:73512",
                    "title" : "Red Hat Security Advisory: gawk security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_73512"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.1.0-6.el9_8.1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.1.0-6.el9_8.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "CVE-2026-40553",
                    "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                    "url" : "https://www.redhat.com/#CVE-2026-40553"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.1.0-6.el9_8.1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.3.0-6.el10_2.1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.1-1.hum1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.0-3.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.1.0-6.el9_8.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                  } ]
                } ]
              }
            }, {
              "id" : "CVE-2026-40468",
              "title" : "Heap buffer overflow in gawk",
              "source" : "redhat-csaf",
              "cvssScore" : 4.4,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2026-40468" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "RHSA-2026:40041",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_40041"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.0-3.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.0-3.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:49661",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_49661"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.1-1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.1-1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:73429",
                    "title" : "Red Hat Security Advisory: gawk security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_73429"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.3.0-6.el10_2.1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.3.0-6.el10_2.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "CVE-2026-40468",
                    "title" : "gawk: gawk: Memory corruption via integer overflow",
                    "url" : "https://www.redhat.com/#CVE-2026-40468"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.0-3.1.hum1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.1.0-6.el9_8.1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.3.0-6.el10_2.1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.1-1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.0-3.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:73512",
                    "title" : "Red Hat Security Advisory: gawk security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_73512"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.1.0-6.el9_8.1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.1.0-6.el9_8.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c."
                  } ]
                } ]
              }
            }, {
              "id" : "CVE-2026-40467",
              "title" : "Use after free in gawk",
              "source" : "redhat-csaf",
              "cvssScore" : 4.0,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2026-40467" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "RHSA-2026:40041",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_40041"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.0-3.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.0-3.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:49661",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_49661"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.1-1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.1-1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:73429",
                    "title" : "Red Hat Security Advisory: gawk security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_73429"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.3.0-6.el10_2.1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.3.0-6.el10_2.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:73512",
                    "title" : "Red Hat Security Advisory: gawk security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_73512"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.1.0-6.el9_8.1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.1.0-6.el9_8.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "CVE-2026-40467",
                    "title" : "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c",
                    "url" : "https://www.redhat.com/#CVE-2026-40467"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.1.0-6.el9_8.1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.3.0-6.el10_2.1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.0-3.1.hum1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.1-1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.1.0-6.el9_8.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources."
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                  } ]
                } ]
              }
            }, {
              "id" : "CVE-2026-40469",
              "title" : "Heap buffer overflow in gawk",
              "source" : "redhat-csaf",
              "cvssScore" : 2.8,
              "severity" : "LOW",
              "cves" : [ "CVE-2026-40469" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "RHSA-2026:40041",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_40041"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.0-3.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.0-3.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:49661",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_49661"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.1-1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.1-1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "CVE-2026-40469",
                    "title" : "gawk: gawk: Denial of Service due to integer overflow",
                    "url" : "https://www.redhat.com/#CVE-2026-40469"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.0-3.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.0-3.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
                  } ]
                } ]
              }
            } ],
            "transitive" : [ ],
            "highestVulnerability" : {
              "id" : "CVE-2026-40553",
              "title" : "Stack-based buffer overflow in gawk",
              "source" : "redhat-csaf",
              "cvssScore" : 6.2,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2026-40553" ],
              "unique" : false,
              "remediation" : {
                "fixedIn" : [ "5.1.0-6.el9_8.1", "5.3.0-6.el10_2.1", "5.4.0-3.1.hum1", "5.4.1-1.hum1" ],
                "advisories" : [ {
                  "advisory" : {
                    "id" : "RHSA-2026:40041",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_40041"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.0-3.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.0-3.1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:49661",
                    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
                    "url" : "https://www.redhat.com/#RHSA-2026_49661"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.1-1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.4.1-1.hum1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:73429",
                    "title" : "Red Hat Security Advisory: gawk security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_73429"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.3.0-6.el10_2.1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.3.0-6.el10_2.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "RHSA-2026:73512",
                    "title" : "Red Hat Security Advisory: gawk security update",
                    "url" : "https://www.redhat.com/#RHSA-2026_73512"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.1.0-6.el9_8.1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.1.0-6.el9_8.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                  } ]
                }, {
                  "advisory" : {
                    "id" : "CVE-2026-40553",
                    "title" : "gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service",
                    "url" : "https://www.redhat.com/#CVE-2026-40553"
                  },
                  "status" : "affected",
                  "versionRanges" : [ {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.1.0-6.el9_8.1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.3.0-6.el10_2.1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.1-1.hum1",
                    "highInclusive" : false
                  }, {
                    "versionSchemeId" : "rpm",
                    "highVersion" : "5.4.0-3.1.hum1",
                    "highInclusive" : false
                  } ],
                  "fixedIn" : "5.1.0-6.el9_8.1",
                  "remediations" : [ {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73512"
                  }, {
                    "category" : "WORKAROUND",
                    "details" : "Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution."
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:73429"
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:49661"
                  }, {
                    "category" : "VENDOR_FIX",
                    "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
                    "url" : "https://access.redhat.com/errata/RHSA-2026:40041"
                  } ]
                } ]
              }
            }
          } ]
        }
      },
      "recommendations" : { }
    }
  },
  "licenses" : [ {
    "status" : {
      "ok" : true,
      "name" : "deps.dev",
      "warnings" : { }
    },
    "summary" : {
      "total" : 0,
      "concluded" : 106,
      "permissive" : 0,
      "weakCopyleft" : 0,
      "strongCopyleft" : 0,
      "unknown" : 0,
      "deprecated" : 0,
      "osiApproved" : 0,
      "fsfLibre" : 0
    },
    "packages" : {
      "pkg:rpm/redhat/openssl-libs@3.0.7-16.el9_2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/json-c@0.14-11.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libzstd@1.5.1-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libnghttp2@1.43.0-5.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libusbx@1.0.26-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:oci/multi-component-parent-image@sha256%3A87898f08a68d87084dc88ae537a30857f0e940335b3b90242c7c0718592c24eb" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/alternatives@1.20-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcap-ng@0.8.2-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/microdnf@3.9.1-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libgpg-error@1.42-5.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libunistring@0.9.10-15.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsmartcols@2.37.4-11.el9_2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/p11-kit@0.24.1-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/audit-libs@3.0.7-103.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gmp@6.2.0-10.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libpeas@1.30.0-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/basesystem@11-13.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/filesystem@3.16-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/pcre2-syntax@10.40-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libidn2@2.3.0-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/grep@3.6-5.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/crypto-policies@20221215-1.git9a18988.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libuuid@2.37.4-11.el9_2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsigsegv@2.13-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glib2@2.68.4-6.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/pcre2@10.40-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gawk@5.1.0-6.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gnutls@3.7.6-20.el9_2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/openldap-compat@2.6.2-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsepol@3.5-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/readline@8.1-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/rpm-libs@4.16.1.3-22.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/cyrus-sasl-lib@2.1.27-21.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/lz4-libs@1.9.3-5.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libacl@2.3.1-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glibc-common@2.34-60.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libffi@3.4.2-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcap@2.48-8.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gpg-pubkey@5a6340b3-6229229e" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcurl-minimal@7.76.1-23.el9_2.1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libmodulemd@2.13.0-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libmount@2.37.4-11.el9_2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/dejavu-sans-fonts@2.37-18.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/sed@4.8-9.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/zlib@1.2.11-39.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/curl-minimal@7.76.1-23.el9_2.1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libattr@2.5.1-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gdbm-libs@1.19-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/dnf-data@4.14.0-5.el9_2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/ca-certificates@2022.2.54-90.2.el9_0" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/bash@5.1.8-6.el9_1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/rootfiles@8.1-31.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/json-glib@1.6.6-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libstdc%2B%2B@11.3.1-4.3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gobject-introspection@1.68.0-11.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gnupg2@2.3.3-2.el9_0" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libevent@2.1.12-6.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gpg-pubkey@fd431d51-4ae0493b" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/fonts-filesystem@2.0.5-7.el9.1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/redhat-release@9.2-0.13.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/langpacks-core-en@3.0-16.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/nettle@3.8-3.el9_0" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libreport-filesystem@2.15.2-6.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/langpacks-core-font-en@3.0-16.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libverto@0.3.2-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/librepo@1.14.5-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libblkid@2.37.4-11.el9_2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/systemd-libs@252-14.el9_2.1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libxml2@2.9.13-3.el9_1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/npth@1.6-8.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/krb5-libs@1.20.1-9.el9_2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/rpm@4.16.1.3-22.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/pcre@8.44-3.el9.3" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libassuan@2.5.5-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsolv@0.7.22-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/file-libs@5.39-12.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/coreutils-single@8.32-34.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libksba@1.5.1-6.el9_1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libgcrypt@1.10.0-10.el9_2" : {
        "evidence" : [ ]
      },
      "pkg:oci/gl-multi-component-child-awav@sha256%3Aa77d4eb11681f691f6fc408f054688be58d28cd3fbf565b40f52be3aa3769862" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gpgme@1.15.1-6.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/openldap@2.6.2-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/setup@2.13.7-9.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libxcrypt@4.4.18-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libdnf@0.69.0-3.el9_2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/mpfr@4.1.0-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libselinux@3.5-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/keyutils-libs@1.6.3-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcom_err@1.46.5-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libyaml@0.2.5-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/popt@1.18-8.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/bzip2-libs@1.0.8-8.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/librhsm@0.0.3-7.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glibc@2.34-60.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/p11-kit-trust@0.24.1-2.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/lua-libs@5.4.4-3.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/tzdata@2023c-1.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/sqlite-libs@3.34.1-6.el9_1" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libarchive@3.5.3-4.el9" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/langpacks-en@3.0-16.el9" : {
        "evidence" : [ ]
      }
    }
  } ]
}