Inspecting raw image manifest quay.io/redhat-appstudio-qe/build-e2e-iehz/gl-multi-component-parent-omnl@sha256:badb159815bd194448e8b95c94d10dba9893d6696b246062c3edbd3921653a1d. Selecting auth Using token for quay.io/redhat-appstudio-qe/build-e2e-iehz/gl-multi-component-parent-omnl Selecting auth Using token for quay.io/redhat-appstudio-qe/build-e2e-iehz/gl-multi-component-parent-omnl WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations. WARNING: Downloading SBOMs this way does not ensure its authenticity. If you want to ensure a tamper-proof SBOM, download it using 'cosign download attestation '. Found SBOM of media type: text/spdx+json Running TPA scan on amd64 image manifest... % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 241k 0 0 100 241k 0 200k 0:00:01 0:00:01 --:--:-- 200k 100 241k 0 0 100 241k 0 109k 0:00:02 0:00:02 --:--:-- 109k 100 241k 0 0 100 241k 0 77071 0:00:03 0:00:03 --:--:-- 77095 100 241k 0 0 100 241k 0 58746 0:00:04 0:00:04 --:--:-- 58746 100 241k 0 0 100 241k 0 47461 0:00:05 0:00:05 --:--:-- 47470 100 241k 0 0 100 241k 0 39813 0:00:06 0:00:06 --:--:-- 0 100 241k 0 0 100 241k 0 34288 0:00:07 0:00:07 --:--:-- 0 100 241k 0 0 100 241k 0 30109 0:00:08 0:00:08 --:--:-- 0 100 241k 0 0 100 241k 0 26839 0:00:09 0:00:09 --:--:-- 0 100 241k 0 0 100 241k 0 24209 0:00:10 0:00:10 --:--:-- 0 100 241k 0 0 100 241k 0 22048 0:00:11 0:00:11 --:--:-- 0 100 241k 0 0 100 241k 0 20242 0:00:12 0:00:12 --:--:-- 0 100 241k 0 0 100 241k 0 18709 0:00:13 0:00:13 --:--:-- 0 100 241k 0 0 100 241k 0 17392 0:00:14 0:00:14 --:--:-- 0 100 241k 0 0 100 241k 0 16248 0:00:15 0:00:15 --:--:-- 0 100 241k 0 0 100 241k 0 15246 0:00:16 0:00:16 --:--:-- 0 100 241k 0 0 100 241k 0 14360 0:00:17 0:00:17 --:--:-- 0 100 241k 0 0 100 241k 0 13571 0:00:18 0:00:18 --:--:-- 0 100 241k 0 0 100 241k 0 12864 0:00:19 0:00:19 --:--:-- 0 100 241k 0 0 100 241k 0 12227 0:00:20 0:00:20 --:--:-- 0 100 241k 0 0 100 241k 0 11651 0:00:21 0:00:21 --:--:-- 0 100 241k 0 0 100 241k 0 11126 0:00:22 0:00:22 --:--:-- 0 100 241k 0 0 100 241k 0 10647 0:00:23 0:00:23 --:--:-- 0 100 241k 0 0 100 241k 0 10207 0:00:24 0:00:24 --:--:-- 0 100 241k 0 0 100 241k 0 9802 0:00:25 0:00:25 --:--:-- 0 100 241k 0 0 100 241k 0 9428 0:00:26 0:00:26 --:--:-- 0 100 241k 0 0 100 241k 0 9081 0:00:27 0:00:27 --:--:-- 0 100 241k 0 0 100 241k 0 8759 0:00:28 0:00:28 --:--:-- 0 100 241k 0 0 100 241k 0 8459 0:00:29 0:00:29 --:--:-- 0 100 241k 0 0 100 241k 0 8179 0:00:30 0:00:30 --:--:-- 0 100 241k 0 0 100 241k 0 7917 0:00:31 0:00:31 --:--:-- 0 100 241k 0 0 100 241k 0 7671 0:00:32 0:00:32 --:--:-- 0 100 241k 0 0 100 241k 0 7440 0:00:33 0:00:33 --:--:-- 0 100 241k 0 0 100 241k 0 7223 0:00:34 0:00:34 --:--:-- 0 100 241k 0 0 100 241k 0 7018 0:00:35 0:00:35 --:--:-- 0 100 241k 0 0 100 241k 0 6824 0:00:36 0:00:36 --:--:-- 0 100 241k 0 0 100 241k 0 6640 0:00:37 0:00:37 --:--:-- 0 100 241k 0 0 100 241k 0 6466 0:00:38 0:00:38 --:--:-- 0 100 241k 0 0 100 241k 0 6302 0:00:39 0:00:39 --:--:-- 0 100 241k 0 0 100 241k 0 6145 0:00:40 0:00:40 --:--:-- 0 100 241k 0 0 100 241k 0 5996 0:00:41 0:00:41 --:--:-- 0 100 241k 0 0 100 241k 0 5854 0:00:42 0:00:42 --:--:-- 0 100 241k 0 0 100 241k 0 5718 0:00:43 0:00:43 --:--:-- 0 100 241k 0 0 100 241k 0 5589 0:00:44 0:00:44 --:--:-- 0 100 241k 0 0 100 241k 0 5465 0:00:45 0:00:45 --:--:-- 0 100 241k 0 0 100 241k 0 5347 0:00:46 0:00:46 --:--:-- 0 100 241k 0 0 100 241k 0 5234 0:00:47 0:00:47 --:--:-- 0 100 241k 0 0 100 241k 0 5125 0:00:48 0:00:48 --:--:-- 0 100 241k 0 0 100 241k 0 5021 0:00:49 0:00:49 --:--:-- 0 100 241k 0 0 100 241k 0 4921 0:00:50 0:00:50 --:--:-- 0 100 241k 0 0 100 241k 0 4825 0:00:51 0:00:51 --:--:-- 0 100 241k 0 0 100 241k 0 4732 0:00:52 0:00:52 --:--:-- 0 100 241k 0 0 100 241k 0 4643 0:00:53 0:00:53 --:--:-- 0 100 241k 0 0 100 241k 0 4558 0:00:54 0:00:54 --:--:-- 0 100 241k 0 0 100 241k 0 4475 0:00:55 0:00:55 --:--:-- 0 100 241k 0 0 100 241k 0 4395 0:00:56 0:00:56 --:--:-- 0 100 241k 0 0 100 241k 0 4319 0:00:57 0:00:57 --:--:-- 0 100 241k 0 0 100 241k 0 4244 0:00:58 0:00:58 --:--:-- 0 100 241k 0 0 100 241k 0 4173 0:00:59 0:00:59 --:--:-- 0 100 241k 0 0 100 241k 0 4103 0:01:00 0:01:00 --:--:-- 0 100 241k 0 0 100 241k 0 4036 0:01:01 0:01:01 --:--:-- 0 100 241k 0 0 100 241k 0 3971 0:01:02 0:01:02 --:--:-- 0 100 241k 0 0 100 241k 0 3909 0:01:03 0:01:03 --:--:-- 0 100 241k 0 0 100 241k 0 3848 0:01:04 0:01:04 --:--:-- 0 100 241k 0 0 100 241k 0 3789 0:01:05 0:01:05 --:--:-- 0 100 241k 0 0 100 241k 0 3731 0:01:06 0:01:06 --:--:-- 0 100 241k 0 0 100 241k 0 3676 0:01:07 0:01:07 --:--:-- 0 100 241k 0 0 100 241k 0 3622 0:01:08 0:01:08 --:--:-- 0 100 241k 0 0 100 241k 0 3570 0:01:09 0:01:09 --:--:-- 0 100 241k 0 0 100 241k 0 3519 0:01:10 0:01:10 --:--:-- 0 100 241k 0 0 100 241k 0 3469 0:01:11 0:01:11 --:--:-- 0 100 241k 0 0 100 241k 0 3421 0:01:12 0:01:12 --:--:-- 0 100 241k 0 0 100 241k 0 3375 0:01:13 0:01:13 --:--:-- 0 100 241k 0 0 100 241k 0 3329 0:01:14 0:01:14 --:--:-- 0 100 241k 0 0 100 241k 0 3285 0:01:15 0:01:15 --:--:-- 0 100 241k 0 0 100 241k 0 3242 0:01:16 0:01:16 --:--:-- 0 100 241k 0 0 100 241k 0 3200 0:01:17 0:01:17 --:--:-- 0 100 241k 0 0 100 241k 0 3159 0:01:18 0:01:18 --:--:-- 0 100 241k 0 0 100 241k 0 3119 0:01:19 0:01:19 --:--:-- 0 100 241k 0 0 100 241k 0 3080 0:01:20 0:01:20 --:--:-- 0 100 241k 0 0 100 241k 0 3042 0:01:21 0:01:21 --:--:-- 0 100 241k 0 0 100 241k 0 3005 0:01:22 0:01:22 --:--:-- 0 100 241k 0 0 100 241k 0 2969 0:01:23 0:01:23 --:--:-- 0 100 241k 0 0 100 241k 0 2934 0:01:24 0:01:24 --:--:-- 0 100 241k 0 0 100 241k 0 2899 0:01:25 0:01:25 --:--:-- 0 100 241k 0 0 100 241k 0 2866 0:01:26 0:01:26 --:--:-- 0 100 241k 0 0 100 241k 0 2833 0:01:27 0:01:27 --:--:-- 0 100 241k 0 0 100 241k 0 2801 0:01:28 0:01:28 --:--:-- 0 100 241k 0 0 100 241k 0 2769 0:01:29 0:01:29 --:--:-- 0 100 241k 0 0 100 241k 0 2738 0:01:30 0:01:30 --:--:-- 0 100 241k 0 0 100 241k 0 2708 0:01:31 0:01:31 --:--:-- 0 100 241k 0 0 100 241k 0 2679 0:01:32 0:01:32 --:--:-- 0 100 241k 0 0 100 241k 0 2650 0:01:33 0:01:33 --:--:-- 0 100 241k 0 0 100 241k 0 2622 0:01:34 0:01:34 --:--:-- 0 100 241k 0 0 100 241k 0 2595 0:01:35 0:01:35 --:--:-- 0 100 241k 0 0 100 241k 0 2568 0:01:36 0:01:36 --:--:-- 0 100 241k 0 0 100 241k 0 2541 0:01:37 0:01:37 --:--:-- 0 100 241k 0 0 100 241k 0 2515 0:01:38 0:01:38 --:--:-- 0 100 241k 0 0 100 241k 0 2490 0:01:39 0:01:39 --:--:-- 0 100 241k 0 0 100 241k 0 2465 0:01:40 0:01:40 --:--:-- 0 100 241k 0 0 100 241k 0 2441 0:01:41 0:01:41 --:--:-- 0 100 241k 0 0 100 241k 0 2417 0:01:42 0:01:42 --:--:-- 0 100 241k 0 0 100 241k 0 2393 0:01:43 0:01:43 --:--:-- 0 100 241k 0 0 100 241k 0 2370 0:01:44 0:01:44 --:--:-- 0 100 241k 0 0 100 241k 0 2348 0:01:45 0:01:45 --:--:-- 0 100 241k 0 0 100 241k 0 2326 0:01:46 0:01:46 --:--:-- 0 100 241k 0 0 100 241k 0 2304 0:01:47 0:01:47 --:--:-- 0 100 241k 0 0 100 241k 0 2283 0:01:48 0:01:48 --:--:-- 0 100 241k 0 0 100 241k 0 2262 0:01:49 0:01:49 --:--:-- 0 100 241k 0 0 100 241k 0 2241 0:01:50 0:01:50 --:--:-- 0 100 241k 0 0 100 241k 0 2221 0:01:51 0:01:51 --:--:-- 0 100 241k 0 0 100 241k 0 2201 0:01:52 0:01:52 --:--:-- 0 100 241k 0 0 100 241k 0 2182 0:01:53 0:01:53 --:--:-- 0 100 241k 0 0 100 241k 0 2163 0:01:54 0:01:54 --:--:-- 0 100 241k 0 0 100 241k 0 2144 0:01:55 0:01:55 --:--:-- 0 100 241k 0 0 100 241k 0 2126 0:01:56 0:01:56 --:--:-- 0 100 241k 0 0 100 241k 0 2108 0:01:57 0:01:57 --:--:-- 0 100 241k 0 0 100 241k 0 2090 0:01:58 0:01:58 --:--:-- 0 100 241k 0 0 100 241k 0 2072 0:01:59 0:01:59 --:--:-- 0 100 241k 0 0 100 241k 0 2055 0:02:00 0:02:00 --:--:-- 0 100 241k 0 0 100 241k 0 2038 0:02:01 0:02:01 --:--:-- 0 100 241k 0 0 100 241k 0 2021 0:02:02 0:02:02 --:--:-- 0 100 241k 0 0 100 241k 0 2005 0:02:03 0:02:03 --:--:-- 0 100 241k 0 0 100 241k 0 1989 0:02:04 0:02:04 --:--:-- 0 100 241k 0 0 100 241k 0 1973 0:02:05 0:02:05 --:--:-- 0 100 241k 0 0 100 241k 0 1957 0:02:06 0:02:06 --:--:-- 0 100 241k 0 0 100 241k 0 1942 0:02:07 0:02:07 --:--:-- 0 100 241k 0 0 100 241k 0 1927 0:02:08 0:02:08 --:--:-- 0 100 241k 0 0 100 241k 0 1912 0:02:09 0:02:09 --:--:-- 0 100 241k 0 0 100 241k 0 1897 0:02:10 0:02:10 --:--:-- 0 100 241k 0 0 100 241k 0 1883 0:02:11 0:02:11 --:--:-- 0 100 241k 0 0 100 241k 0 1868 0:02:12 0:02:12 --:--:-- 0 100 241k 0 0 100 241k 0 1854 0:02:13 0:02:13 --:--:-- 0 100 241k 0 0 100 241k 0 1841 0:02:14 0:02:14 --:--:-- 0 100 241k 0 0 100 241k 0 1827 0:02:15 0:02:15 --:--:-- 0 100 241k 0 0 100 241k 0 1813 0:02:16 0:02:16 --:--:-- 0 100 241k 0 0 100 241k 0 1800 0:02:17 0:02:17 --:--:-- 0 100 241k 0 0 100 241k 0 1787 0:02:18 0:02:18 --:--:-- 0 100 241k 0 0 100 241k 0 1774 0:02:19 0:02:19 --:--:-- 0 100 241k 0 0 100 241k 0 1762 0:02:20 0:02:20 --:--:-- 0 100 241k 0 0 100 241k 0 1749 0:02:21 0:02:21 --:--:-- 0 100 241k 0 0 100 241k 0 1737 0:02:22 0:02:22 --:--:-- 0 100 241k 0 0 100 241k 0 1725 0:02:23 0:02:23 --:--:-- 0 100 241k 0 0 100 241k 0 1713 0:02:24 0:02:24 --:--:-- 0 100 241k 0 0 100 241k 0 1701 0:02:25 0:02:25 --:--:-- 0 100 241k 0 0 100 241k 0 1689 0:02:26 0:02:26 --:--:-- 0 100 241k 0 0 100 241k 0 1678 0:02:27 0:02:27 --:--:-- 0 100 241k 0 0 100 241k 0 1667 0:02:28 0:02:28 --:--:-- 0 100 241k 0 0 100 241k 0 1655 0:02:29 0:02:29 --:--:-- 0 100 241k 0 0 100 241k 0 1648 0:02:30 0:02:30 --:--:-- 0 100 241k 0 0 100 241k 0 1637 0:02:31 0:02:31 --:--:-- 0 100 241k 0 0 100 241k 0 1627 0:02:32 0:02:32 --:--:-- 0 100 241k 0 0 100 241k 0 1616 0:02:33 0:02:33 --:--:-- 0 100 241k 0 0 100 241k 0 1605 0:02:34 0:02:34 --:--:-- 0 100 241k 0 0 100 241k 0 1595 0:02:35 0:02:35 --:--:-- 0 100 241k 0 0 100 241k 0 1585 0:02:36 0:02:36 --:--:-- 0 100 241k 0 0 100 241k 0 1575 0:02:37 0:02:37 --:--:-- 0 100 241k 0 0 100 241k 0 1565 0:02:38 0:02:38 --:--:-- 0 100 241k 0 0 100 241k 0 1555 0:02:39 0:02:39 --:--:-- 0 100 241k 0 0 100 241k 0 1545 0:02:40 0:02:40 --:--:-- 0 100 241k 0 0 100 241k 0 1536 0:02:41 0:02:41 --:--:-- 0 100 241k 0 0 100 241k 0 1526 0:02:42 0:02:42 --:--:-- 0 100 241k 0 0 100 241k 0 1517 0:02:43 0:02:43 --:--:-- 0 100 241k 0 0 100 241k 0 1507 0:02:44 0:02:44 --:--:-- 0 100 241k 0 0 100 241k 0 1498 0:02:45 0:02:45 --:--:-- 0 100 241k 0 0 100 241k 0 1489 0:02:46 0:02:46 --:--:-- 0 100 241k 0 0 100 241k 0 1480 0:02:47 0:02:47 --:--:-- 0 100 241k 0 0 100 241k 0 1471 0:02:48 0:02:48 --:--:-- 0 100 241k 0 0 100 241k 0 1463 0:02:49 0:02:49 --:--:-- 0 100 241k 0 0 100 241k 0 1454 0:02:50 0:02:50 --:--:-- 0 100 241k 0 0 100 241k 0 1446 0:02:51 0:02:51 --:--:-- 0 100 241k 0 0 100 241k 0 1437 0:02:52 0:02:52 --:--:-- 0 100 241k 0 0 100 241k 0 1429 0:02:53 0:02:53 --:--:-- 0 100 241k 0 0 100 241k 0 1421 0:02:54 0:02:54 --:--:-- 0 100 241k 0 0 100 241k 0 1413 0:02:55 0:02:55 --:--:-- 0 100 241k 0 0 100 241k 0 1404 0:02:56 0:02:56 --:--:-- 0 100 241k 0 0 100 241k 0 1397 0:02:57 0:02:57 --:--:-- 0 100 241k 0 0 100 241k 0 1389 0:02:58 0:02:58 --:--:-- 0 100 241k 0 0 100 241k 0 1381 0:02:59 0:02:59 --:--:-- 0 100 241k 0 0 100 241k 0 1373 0:03:00 0:03:00 --:--:-- 0 99 241k 0 0 100 241k 0 1373 0:03:00 0:03:00 --:--:-- 0 curl: (22) The requested URL returned error: 504 info: Retrying again in 5 seconds... % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 241k 0 0 100 241k 0 200k 0:00:01 0:00:01 --:--:-- 200k 100 241k 0 0 100 241k 0 109k 0:00:02 0:00:02 --:--:-- 109k 100 241k 0 0 100 241k 0 77143 0:00:03 0:00:03 --:--:-- 77143 100 241k 0 0 100 241k 0 58788 0:00:04 0:00:04 --:--:-- 58788 100 241k 0 0 100 241k 0 47489 0:00:05 0:00:05 --:--:-- 47489 100 241k 0 0 100 241k 0 39832 0:00:06 0:00:06 --:--:-- 0 100 241k 0 0 100 241k 0 34302 0:00:07 0:00:07 --:--:-- 0 100 241k 0 0 100 241k 0 30120 0:00:08 0:00:08 --:--:-- 0 100 241k 0 0 100 241k 0 26847 0:00:09 0:00:09 --:--:-- 0 100 241k 0 0 100 241k 0 24216 0:00:10 0:00:10 --:--:-- 0 100 241k 0 0 100 241k 0 22054 0:00:11 0:00:11 --:--:-- 0 100 241k 0 0 100 241k 0 20247 0:00:12 0:00:12 --:--:-- 0 100 241k 0 0 100 241k 0 18713 0:00:13 0:00:13 --:--:-- 0 100 241k 0 0 100 241k 0 17396 0:00:14 0:00:14 --:--:-- 0 100 241k 0 0 100 241k 0 16252 0:00:15 0:00:15 --:--:-- 0 100 241k 0 0 100 241k 0 15248 0:00:16 0:00:16 --:--:-- 0 100 241k 0 0 100 241k 0 14361 0:00:17 0:00:17 --:--:-- 0 100 241k 0 0 100 241k 0 13573 0:00:18 0:00:18 --:--:-- 0 100 241k 0 0 100 241k 0 12866 0:00:19 0:00:19 --:--:-- 0 100 241k 0 0 100 241k 0 12229 0:00:20 0:00:20 --:--:-- 0 100 241k 0 0 100 241k 0 11652 0:00:21 0:00:21 --:--:-- 0 100 241k 0 0 100 241k 0 11128 0:00:22 0:00:22 --:--:-- 0 100 241k 0 0 100 241k 0 10648 0:00:23 0:00:23 --:--:-- 0 100 241k 0 0 100 241k 0 10208 0:00:24 0:00:24 --:--:-- 0 100 241k 0 0 100 241k 0 9803 0:00:25 0:00:25 --:--:-- 0 100 241k 0 0 100 241k 0 9429 0:00:26 0:00:26 --:--:-- 0 100 241k 0 0 100 241k 0 9082 0:00:27 0:00:27 --:--:-- 0 100 241k 0 0 100 241k 0 8760 0:00:28 0:00:28 --:--:-- 0 100 241k 0 0 100 241k 0 8460 0:00:29 0:00:29 --:--:-- 0 100 241k 0 0 100 241k 0 8180 0:00:30 0:00:30 --:--:-- 0 100 241k 0 0 100 241k 0 7918 0:00:31 0:00:31 --:--:-- 0 100 241k 0 0 100 241k 0 7672 0:00:32 0:00:32 --:--:-- 0 100 241k 0 0 100 241k 0 7441 0:00:33 0:00:33 --:--:-- 0 100 241k 0 0 100 241k 0 7224 0:00:34 0:00:34 --:--:-- 0 100 241k 0 0 100 241k 0 7018 0:00:35 0:00:35 --:--:-- 0 100 241k 0 0 100 241k 0 6824 0:00:36 0:00:36 --:--:-- 0 100 241k 0 0 100 241k 0 6641 0:00:37 0:00:37 --:--:-- 0 100 241k 0 0 100 241k 0 6467 0:00:38 0:00:38 --:--:-- 0 100 241k 0 0 100 241k 0 6302 0:00:39 0:00:39 --:--:-- 0 100 241k 0 0 100 241k 0 6145 0:00:40 0:00:40 --:--:-- 0 100 241k 0 0 100 241k 0 5996 0:00:41 0:00:41 --:--:-- 0 100 241k 0 0 100 241k 0 5854 0:00:42 0:00:42 --:--:-- 0 100 241k 0 0 100 241k 0 5718 0:00:43 0:00:43 --:--:-- 0 100 241k 0 0 100 241k 0 5589 0:00:44 0:00:44 --:--:-- 0 100 241k 0 0 100 241k 0 5465 0:00:45 0:00:45 --:--:-- 0 100 241k 0 0 100 241k 0 5347 0:00:46 0:00:46 --:--:-- 0 100 241k 0 0 100 241k 0 5234 0:00:47 0:00:47 --:--:-- 0 100 241k 0 0 100 241k 0 5125 0:00:48 0:00:48 --:--:-- 0 100 241k 0 0 100 241k 0 5021 0:00:49 0:00:49 --:--:-- 0 100 241k 0 0 100 241k 0 4921 0:00:50 0:00:50 --:--:-- 0 100 241k 0 0 100 241k 0 4825 0:00:51 0:00:51 --:--:-- 0 100 241k 0 0 100 241k 0 4732 0:00:52 0:00:52 --:--:-- 0 100 241k 0 0 100 241k 0 4643 0:00:53 0:00:53 --:--:-- 0 100 241k 0 0 100 241k 0 4558 0:00:54 0:00:54 --:--:-- 0 100 241k 0 0 100 241k 0 4475 0:00:55 0:00:55 --:--:-- 0 100 241k 0 0 100 241k 0 4396 0:00:56 0:00:56 --:--:-- 0 100 241k 0 0 100 241k 0 4319 0:00:57 0:00:57 --:--:-- 0 100 241k 0 0 100 241k 0 4245 0:00:58 0:00:58 --:--:-- 0 100 241k 0 0 100 241k 0 4173 0:00:59 0:00:59 --:--:-- 0 100 241k 0 0 100 241k 0 4104 0:01:00 0:01:00 --:--:-- 0 100 241k 0 0 100 241k 0 4037 0:01:01 0:01:01 --:--:-- 0 100 241k 0 0 100 241k 0 3972 0:01:02 0:01:02 --:--:-- 0 100 241k 0 0 100 241k 0 3909 0:01:03 0:01:03 --:--:-- 0 100 241k 0 0 100 241k 0 3848 0:01:04 0:01:04 --:--:-- 0 100 241k 0 0 100 241k 0 3789 0:01:05 0:01:05 --:--:-- 0 100 241k 0 0 100 241k 0 3732 0:01:06 0:01:06 --:--:-- 0 100 241k 0 0 100 241k 0 3676 0:01:07 0:01:07 --:--:-- 0 100 241k 0 0 100 241k 0 3622 0:01:08 0:01:08 --:--:-- 0 100 241k 0 0 100 241k 0 3570 0:01:09 0:01:09 --:--:-- 0 100 241k 0 0 100 241k 0 3519 0:01:10 0:01:10 --:--:-- 0 100 241k 0 0 100 241k 0 3470 0:01:11 0:01:11 --:--:-- 0 100 241k 0 0 100 241k 0 3421 0:01:12 0:01:12 --:--:-- 0 100 241k 0 0 100 241k 0 3375 0:01:13 0:01:13 --:--:-- 0 100 241k 0 0 100 241k 0 3329 0:01:14 0:01:14 --:--:-- 0 100 241k 0 0 100 241k 0 3285 0:01:15 0:01:15 --:--:-- 0 100 241k 0 0 100 241k 0 3242 0:01:16 0:01:16 --:--:-- 0 100 241k 0 0 100 241k 0 3200 0:01:17 0:01:17 --:--:-- 0 100 241k 0 0 100 241k 0 3159 0:01:18 0:01:18 --:--:-- 0 100 241k 0 0 100 241k 0 3119 0:01:19 0:01:19 --:--:-- 0 100 241k 0 0 100 241k 0 3080 0:01:20 0:01:20 --:--:-- 0 100 241k 0 0 100 241k 0 3042 0:01:21 0:01:21 --:--:-- 0 100 241k 0 0 100 241k 0 3005 0:01:22 0:01:22 --:--:-- 0 100 241k 0 0 100 241k 0 2969 0:01:23 0:01:23 --:--:-- 0 100 241k 0 0 100 241k 0 2934 0:01:24 0:01:24 --:--:-- 0 100 241k 0 0 100 241k 0 2899 0:01:25 0:01:25 --:--:-- 0 100 241k 0 0 100 241k 0 2866 0:01:26 0:01:26 --:--:-- 0 100 241k 0 0 100 241k 0 2833 0:01:27 0:01:27 --:--:-- 0 100 241k 0 0 100 241k 0 2801 0:01:28 0:01:28 --:--:-- 0 100 241k 0 0 100 241k 0 2769 0:01:29 0:01:29 --:--:-- 0 100 241k 0 0 100 241k 0 2739 0:01:30 0:01:30 --:--:-- 0 100 241k 0 0 100 241k 0 2709 0:01:31 0:01:31 --:--:-- 0 100 241k 0 0 100 241k 0 2679 0:01:32 0:01:32 --:--:-- 0 100 241k 0 0 100 241k 0 2651 0:01:33 0:01:33 --:--:-- 0 100 241k 0 0 100 241k 0 2622 0:01:34 0:01:34 --:--:-- 0 100 241k 0 0 100 241k 0 2595 0:01:35 0:01:35 --:--:-- 0 100 241k 0 0 100 241k 0 2568 0:01:36 0:01:36 --:--:-- 0 100 241k 0 0 100 241k 0 2541 0:01:37 0:01:37 --:--:-- 0 100 241k 0 0 100 241k 0 2516 0:01:38 0:01:38 --:--:-- 0 100 241k 0 0 100 241k 0 2490 0:01:39 0:01:39 --:--:-- 0 100 241k 0 0 100 241k 0 2465 0:01:40 0:01:40 --:--:-- 0 100 241k 0 0 100 241k 0 2441 0:01:41 0:01:41 --:--:-- 0 100 241k 0 0 100 241k 0 2417 0:01:42 0:01:42 --:--:-- 0 100 241k 0 0 100 241k 0 2394 0:01:43 0:01:43 --:--:-- 0 100 241k 0 0 100 241k 0 2371 0:01:44 0:01:44 --:--:-- 0 100 241k 0 0 100 241k 0 2348 0:01:45 0:01:45 --:--:-- 0 100 241k 0 0 100 241k 0 2326 0:01:46 0:01:46 --:--:-- 0 100 241k 0 0 100 241k 0 2304 0:01:47 0:01:47 --:--:-- 0 100 241k 0 0 100 241k 0 2283 0:01:48 0:01:48 --:--:-- 0 100 241k 0 0 100 241k 0 2262 0:01:49 0:01:49 --:--:-- 0 100 241k 0 0 100 241k 0 2242 0:01:50 0:01:50 --:--:-- 0 100 241k 0 0 100 241k 0 2221 0:01:51 0:01:51 --:--:-- 0 100 241k 0 0 100 241k 0 2202 0:01:52 0:01:52 --:--:-- 0 100 241k 0 0 100 241k 0 2182 0:01:53 0:01:53 --:--:-- 0 100 241k 0 0 100 241k 0 2163 0:01:54 0:01:54 --:--:-- 0 100 241k 0 0 100 241k 0 2144 0:01:55 0:01:55 --:--:-- 0 100 241k 0 0 100 241k 0 2126 0:01:56 0:01:56 --:--:-- 0 100 241k 0 0 100 241k 0 2108 0:01:57 0:01:57 --:--:-- 0 100 241k 0 0 100 241k 0 2090 0:01:58 0:01:58 --:--:-- 0 100 241k 0 0 100 241k 0 2072 0:01:59 0:01:59 --:--:-- 0 100 241k 0 0 100 241k 0 2055 0:02:00 0:02:00 --:--:-- 0 100 241k 0 0 100 241k 0 2038 0:02:01 0:02:01 --:--:-- 0 100 241k 0 0 100 241k 0 2021 0:02:02 0:02:02 --:--:-- 0 100 241k 0 0 100 241k 0 2005 0:02:03 0:02:03 --:--:-- 0 100 241k 0 0 100 241k 0 1989 0:02:04 0:02:04 --:--:-- 0 100 241k 0 0 100 241k 0 1973 0:02:05 0:02:05 --:--:-- 0 100 241k 0 0 100 241k 0 1957 0:02:06 0:02:06 --:--:-- 0 100 241k 0 0 100 241k 0 1942 0:02:07 0:02:07 --:--:-- 0 100 241k 0 0 100 241k 0 1927 0:02:08 0:02:08 --:--:-- 0 100 241k 0 0 100 241k 0 1912 0:02:09 0:02:09 --:--:-- 0 100 241k 0 0 100 241k 0 1897 0:02:10 0:02:10 --:--:-- 0 100 241k 0 0 100 241k 0 1883 0:02:11 0:02:11 --:--:-- 0 100 241k 0 0 100 241k 0 1868 0:02:12 0:02:12 --:--:-- 0 100 241k 0 0 100 241k 0 1854 0:02:13 0:02:13 --:--:-- 0 100 241k 0 0 100 241k 0 1841 0:02:14 0:02:14 --:--:-- 0 100 241k 0 0 100 241k 0 1827 0:02:15 0:02:15 --:--:-- 0 100 241k 0 0 100 241k 0 1814 0:02:16 0:02:16 --:--:-- 0 100 241k 0 0 100 241k 0 1800 0:02:17 0:02:17 --:--:-- 0 100 241k 0 0 100 241k 0 1787 0:02:18 0:02:18 --:--:-- 0 100 241k 0 0 100 241k 0 1774 0:02:19 0:02:19 --:--:-- 0 100 241k 0 0 100 241k 0 1762 0:02:20 0:02:20 --:--:-- 0 100 241k 0 0 100 241k 0 1749 0:02:21 0:02:21 --:--:-- 0 100 241k 0 0 100 241k 0 1737 0:02:22 0:02:22 --:--:-- 0 100 241k 0 0 100 241k 0 1725 0:02:23 0:02:23 --:--:-- 0 100 241k 0 0 100 241k 0 1713 0:02:24 0:02:24 --:--:-- 0 100 241k 0 0 100 241k 0 1701 0:02:25 0:02:25 --:--:-- 0 100 241k 0 0 100 241k 0 1689 0:02:26 0:02:26 --:--:-- 0 100 241k 0 0 100 241k 0 1678 0:02:27 0:02:27 --:--:-- 0 100 241k 0 0 100 241k 0 1667 0:02:28 0:02:28 --:--:-- 0 100 241k 0 0 100 241k 0 1655 0:02:29 0:02:29 --:--:-- 0 100 241k 0 0 100 241k 0 1648 0:02:30 0:02:30 --:--:-- 0 100 241k 0 0 100 241k 0 1637 0:02:31 0:02:31 --:--:-- 0 100 241k 0 0 100 241k 0 1627 0:02:32 0:02:32 --:--:-- 0 100 241k 0 0 100 241k 0 1616 0:02:33 0:02:33 --:--:-- 0 100 241k 0 0 100 241k 0 1605 0:02:34 0:02:34 --:--:-- 0 100 241k 0 0 100 241k 0 1595 0:02:35 0:02:35 --:--:-- 0 100 241k 0 0 100 241k 0 1585 0:02:36 0:02:36 --:--:-- 0 100 241k 0 0 100 241k 0 1575 0:02:37 0:02:37 --:--:-- 0 100 241k 0 0 100 241k 0 1565 0:02:38 0:02:38 --:--:-- 0 100 241k 0 0 100 241k 0 1555 0:02:39 0:02:39 --:--:-- 0 100 241k 0 0 100 241k 0 1545 0:02:40 0:02:40 --:--:-- 0 100 241k 0 0 100 241k 0 1536 0:02:41 0:02:41 --:--:-- 0 100 241k 0 0 100 241k 0 1526 0:02:42 0:02:42 --:--:-- 0 100 241k 0 0 100 241k 0 1517 0:02:43 0:02:43 --:--:-- 0 100 241k 0 0 100 241k 0 1507 0:02:44 0:02:44 --:--:-- 0 100 241k 0 0 100 241k 0 1498 0:02:45 0:02:45 --:--:-- 0 100 241k 0 0 100 241k 0 1489 0:02:46 0:02:46 --:--:-- 0 100 241k 0 0 100 241k 0 1480 0:02:47 0:02:47 --:--:-- 0 100 241k 0 0 100 241k 0 1471 0:02:48 0:02:48 --:--:-- 0 100 241k 0 0 100 241k 0 1463 0:02:49 0:02:49 --:--:-- 0 100 241k 0 0 100 241k 0 1454 0:02:50 0:02:50 --:--:-- 0 100 241k 0 0 100 241k 0 1446 0:02:51 0:02:51 --:--:-- 0 100 241k 0 0 100 241k 0 1437 0:02:52 0:02:52 --:--:-- 0 100 241k 0 0 100 241k 0 1429 0:02:53 0:02:53 --:--:-- 0 100 241k 0 0 100 241k 0 1421 0:02:54 0:02:54 --:--:-- 0 100 241k 0 0 100 241k 0 1413 0:02:55 0:02:55 --:--:-- 0 100 241k 0 0 100 241k 0 1405 0:02:56 0:02:56 --:--:-- 0 100 241k 0 0 100 241k 0 1397 0:02:57 0:02:57 --:--:-- 0 100 241k 0 0 100 241k 0 1389 0:02:58 0:02:58 --:--:-- 0 100 241k 0 0 100 241k 0 1381 0:02:59 0:02:59 --:--:-- 0 99 241k 0 0 100 241k 0 1373 0:03:00 0:03:00 --:--:-- 0 curl: (22) The requested URL returned error: 504 info: Retrying again in 5 seconds... % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed { "scanned" : { "total" : 122, "direct" : 18, "transitive" : 104 }, "providers" : { "rhtpa" : { "status" : { "ok" : false, "name" : "rhtpa", "code" : 504, "message" : "Request timed out", "warnings" : { } }, "sources" : { "redhat-csaf" : { "summary" : { "direct" : 0, "transitive" : 8, "total" : 8, "dependencies" : 2, "critical" : 0, "high" : 3, "medium" : 2, "low" : 3, "unknown" : 0, "remediations" : 16, "recommendations" : 0, "unscanned" : 0 }, "dependencies" : [ { "ref" : "pkg:rpm/redhat/openssl-libs@3.2.2-6.el9_5.1?arch=x86_64&distro=rhel-9.6&epoch=1&upstream=openssl-3.2.2-6.el9_5.1.src.rpm", "transitive" : [ { "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/microdnf@3.9.1-3.el9?arch=x86_64&distro=rhel-9.6&upstream=microdnf-3.9.1-3.el9.src.rpm", "transitive" : [ { "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/systemd-libs@252-51.el9_6.2?arch=x86_64&distro=rhel-9.6&upstream=systemd-252-51.el9_6.2.src.rpm", "transitive" : [ { "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/libblkid@2.37.4-21.el9?arch=x86_64&distro=rhel-9.6&upstream=util-linux-2.37.4-21.el9.src.rpm", "transitive" : [ { "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 241k 0 0 100 241k 0 200k 0:00:01 0:00:01 --:--:-- 200k 100 241k 0 0 100 241k 0 109k 0:00:02 0:00:02 --:--:-- 109k 100 241k 0 0 100 241k 0 77119 0:00:03 0:00:03 --:--:-- 77143 100 703k 0 462k 100 241k 134k 71791 0:00:03 0:00:03 --:--:-- 204k "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/cyrus-sasl-lib@2.1.27-21.el9?arch=x86_64&distro=rhel-9.6&upstream=cyrus-sasl-2.1.27-21.el9.src.rpm", "transitive" : [ { "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/libusbx@1.0.26-1.el9?arch=x86_64&distro=rhel-9.6&upstream=libusbx-1.0.26-1.el9.src.rpm", "transitive" : [ { "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/libsemanage@3.6-5.el9_6?arch=x86_64&distro=rhel-9.6&upstream=libsemanage-3.6-5.el9_6.src.rpm", "transitive" : [ { "ref" : "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } }, { "ref" : "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=rhel-9.6&upstream=pcre2-10.40-6.el9.src.rpm", "issues" : [ { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } }, { "id" : "CVE-2026-103111", "title" : "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "source" : "redhat-csaf", "cvssScore" : 7.6, "severity" : "HIGH", "cves" : [ "CVE-2026-103111" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.49-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-103111", "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "url" : "https://www.redhat.com/#CVE-2026-103111" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:74972", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "url" : "https://www.redhat.com/#RHSA-2026_74972" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.49-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.49-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:74972" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89161", "title" : "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "source" : "redhat-csaf", "cvssScore" : 7.4, "severity" : "HIGH", "cves" : [ "CVE-2026-89161" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89161", "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "url" : "https://www.redhat.com/#CVE-2026-89161" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89158", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "source" : "redhat-csaf", "cvssScore" : 6.5, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89158" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89158", "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "url" : "https://www.redhat.com/#CVE-2026-89158" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89157", "title" : "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "source" : "redhat-csaf", "cvssScore" : 5.7, "severity" : "MEDIUM", "cves" : [ "CVE-2026-89157" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89157", "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "url" : "https://www.redhat.com/#CVE-2026-89157" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89160", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "source" : "redhat-csaf", "cvssScore" : 3.7, "severity" : "LOW", "cves" : [ "CVE-2026-89160" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89160", "title" : "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "url" : "https://www.redhat.com/#CVE-2026-89160" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89156", "title" : "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89156" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-89156", "title" : "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "url" : "https://www.redhat.com/#CVE-2026-89156" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } }, { "id" : "CVE-2026-89162", "title" : "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "source" : "redhat-csaf", "cvssScore" : 2.9, "severity" : "LOW", "cves" : [ "CVE-2026-89162" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] }, { "advisory" : { "id" : "CVE-2026-89162", "title" : "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "url" : "https://www.redhat.com/#CVE-2026-89162" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ] } ] } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } } ], "highestVulnerability" : { "id" : "CVE-2026-86145", "title" : "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "source" : "redhat-csaf", "cvssScore" : 8.2, "severity" : "HIGH", "cves" : [ "CVE-2026-86145" ], "unique" : false, "remediation" : { "fixedIn" : [ "10.48-0.1.hum1" ], "advisories" : [ { "advisory" : { "id" : "CVE-2026-86145", "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "url" : "https://www.redhat.com/#CVE-2026-86145" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] }, { "advisory" : { "id" : "RHSA-2026:67534", "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update", "url" : "https://www.redhat.com/#RHSA-2026_67534" }, "status" : "affected", "versionRanges" : [ { "versionSchemeId" : "rpm", "highVersion" : "10.48-0.1.hum1", "highInclusive" : false } ], "fixedIn" : "10.48-0.1.hum1", "remediations" : [ { "category" : "VENDOR_FIX", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "url" : "https://access.redhat.com/errata/RHSA-2026:67534" }, { "category" : "WORKAROUND", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively." } ] } ] } } } ] } }, "recommendations" : { } } }, "licenses" : [ { "status" : { "ok" : true, "name" : "deps.dev", "warnings" : { } }, "summary" : { "total" : 0, "concluded" : 110, "permissive" : 0, "weakCopyleft" : 0, "strongCopyleft" : 0, "unknown" : 0, "deprecated" : 0, "osiApproved" : 0, "fsfLibre" : 0 }, "packages" : { "pkg:rpm/redhat/libzstd@1.5.5-1.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/json-c@0.14-11.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/glib2@2.68.4-16.el9_6.2" : { "evidence" : [ ] }, "pkg:rpm/redhat/libusbx@1.0.26-1.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libselinux@3.6-3.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libcap-ng@0.8.2-7.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/microdnf@3.9.1-3.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libgpg-error@1.42-5.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libunistring@0.9.10-15.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libmount@2.37.4-21.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/krb5-libs@1.21.1-8.el9_6" : { "evidence" : [ ] }, "pkg:rpm/redhat/setup@2.13.7-10.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/glibc-common@2.34-168.el9_6.23" : { "evidence" : [ ] }, "pkg:rpm/redhat/libpeas@1.30.0-4.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/openssl-fips-provider@3.0.7-6.el9_5" : { "evidence" : [ ] }, "pkg:rpm/redhat/libdnf@0.69.0-13.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/basesystem@11-13.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libgcc@11.5.0-5.el9_5" : { "evidence" : [ ] }, "pkg:rpm/redhat/libcap@2.48-9.el9_2" : { "evidence" : [ ] }, "pkg:rpm/redhat/libidn2@2.3.0-7.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/grep@3.6-5.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libsigsegv@2.13-4.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/audit-libs@3.1.5-4.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/ca-certificates@2024.2.69_v8.0.303-91.4.el9_4" : { "evidence" : [ ] }, "pkg:rpm/redhat/libksba@1.5.1-7.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libgcrypt@1.10.0-11.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/dnf-data@4.14.0-25.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/openldap@2.6.8-4.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libsemanage@3.6-5.el9_6" : { "evidence" : [ ] }, "pkg:rpm/redhat/gawk@5.1.0-6.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libsmartcols@2.37.4-21.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/librepo@1.14.5-2.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0" : { "evidence" : [ ] }, "pkg:rpm/redhat/libxml2@2.9.13-12.el9_6" : { "evidence" : [ ] }, "pkg:rpm/redhat/readline@8.1-4.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/lua-libs@5.4.4-4.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/sqlite-libs@3.34.1-8.el9_6" : { "evidence" : [ ] }, "pkg:rpm/redhat/cyrus-sasl-lib@2.1.27-21.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/lz4-libs@1.9.3-5.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5" : { "evidence" : [ ] }, "pkg:rpm/redhat/pcre@8.44-4.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/gmp@6.2.0-13.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/tzdata@2025b-1.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/gpg-pubkey@5a6340b3-6229229e" : { "evidence" : [ ] }, "pkg:rpm/redhat/libmodulemd@2.13.0-2.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/dejavu-sans-fonts@2.37-18.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/sed@4.8-9.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/filesystem@3.16-5.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/pcre2@10.40-6.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/openssl-libs@3.2.2-6.el9_5.1" : { "evidence" : [ ] }, "pkg:rpm/redhat/libsolv@0.7.24-3.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libattr@2.5.1-3.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libsepol@3.6-2.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/json-glib@1.6.6-1.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libblkid@2.37.4-21.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/gobject-introspection@1.68.0-11.el9" : { "evidence" : [ ] }, "pkg:oci/gl-multi-component-parent-omnl@sha256%3Abadb159815bd194448e8b95c94d10dba9893d6696b246062c3edbd3921653a1d" : { "evidence" : [ ] }, "pkg:rpm/redhat/libcurl-minimal@7.76.1-31.el9_6.1" : { "evidence" : [ ] }, "pkg:rpm/redhat/rpm-libs@4.16.1.3-37.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/gpg-pubkey@fd431d51-4ae0493b" : { "evidence" : [ ] }, "pkg:rpm/redhat/fonts-filesystem@2.0.5-7.el9.1" : { "evidence" : [ ] }, "pkg:rpm/redhat/nettle@3.10.1-1.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/langpacks-core-en@3.0-16.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libreport-filesystem@2.15.2-6.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/bash@5.1.8-9.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/langpacks-core-font-en@3.0-16.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/zlib@1.2.11-40.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libverto@0.3.2-3.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/shadow-utils@4.9-12.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/glibc@2.34-168.el9_6.23" : { "evidence" : [ ] }, "pkg:rpm/redhat/libnghttp2@1.43.0-6.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/curl-minimal@7.76.1-31.el9_6.1" : { "evidence" : [ ] }, "pkg:rpm/redhat/gnupg2@2.3.3-4.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/npth@1.6-8.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/coreutils-single@8.32-39.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/alternatives@1.24-2.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libcom_err@1.46.5-7.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/gdbm-libs@1.23-1.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/ncurses-libs@6.2-10.20210508.el9_6.2" : { "evidence" : [ ] }, "pkg:rpm/redhat/libassuan@2.5.5-3.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/redhat-release@9.6-0.1.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libuuid@2.37.4-21.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/gpgme@1.15.1-6.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/crypto-policies@20250128-1.git5269e22.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libtasn1@4.16.0-9.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/rpm@4.16.1.3-37.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/systemd-libs@252-51.el9_6.2" : { "evidence" : [ ] }, "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6" : { "evidence" : [ ] }, "pkg:rpm/redhat/libxcrypt@4.4.18-3.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libtool-ltdl@2.4.6-46.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/librhsm@0.0.3-9.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libevent@2.1.12-8.el9_4" : { "evidence" : [ ] }, "pkg:rpm/redhat/glibc-minimal-langpack@2.34-168.el9_6.23" : { "evidence" : [ ] }, "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/ncurses-base@6.2-10.20210508.el9_6.2" : { "evidence" : [ ] }, "pkg:rpm/redhat/mpfr@4.1.0-7.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libffi@3.4.2-8.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/keyutils-libs@1.6.3-1.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/rootfiles@8.1-34.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libacl@2.3.1-4.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libyaml@0.2.5-7.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-6.el9_5" : { "evidence" : [ ] }, "pkg:rpm/redhat/popt@1.18-8.el9" : { "evidence" : [ ] }, "pkg:oci/ubi-minimal@sha256%3A34880b64c07f28f64d95737f82f891516de9a3b43583f39970f7bf8e4cfa48b7" : { "evidence" : [ ] }, "pkg:rpm/redhat/bzip2-libs@1.0.8-10.el9_5" : { "evidence" : [ ] }, "pkg:rpm/redhat/file-libs@5.39-16.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/gnutls@3.8.3-6.el9_6.2" : { "evidence" : [ ] }, "pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5" : { "evidence" : [ ] }, "pkg:rpm/redhat/langpacks-en@3.0-16.el9" : { "evidence" : [ ] }, "pkg:rpm/redhat/libstdc%2B%2B@11.5.0-5.el9_5" : { "evidence" : [ ] } } } ] }