Inspecting raw image manifest quay.io/redhat-appstudio-qe/build-e2e-cinv/gh-multi-component-child-ejvc@sha256:be54f204fdf75d5f4e72675789c1cb76831f32be8a31d75df88193e653eb3916.
Selecting auth
Using token for quay.io/redhat-appstudio-qe/build-e2e-cinv/gh-multi-component-child-ejvc
Selecting auth
Using token for quay.io/redhat-appstudio-qe/build-e2e-cinv/gh-multi-component-child-ejvc
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Downloading SBOMs this way does not ensure its authenticity. If you want to ensure a tamper-proof SBOM, download it using 'cosign download attestation <image uri>'.
Found SBOM of media type: text/spdx+json
Running TPA scan on amd64 image manifest...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100  229k    0     0  100  229k      0  1098k --:--:-- --:--:-- --:--:-- 1092k{
  "scanned" : {
    "total" : 122,
    "direct" : 23,
    "transitive" : 99
  },
  "providers" : {
    "rhtpa" : {
      "status" : {
        "ok" : true,
        "name" : "rhtpa",
        "code" : 200,
        "message" : "OK",
        "warnings" : { }
      },
      "sources" : {
        "redhat-csaf" : {
          "summary" : {
            "direct" : 22,
            "transitive" : 200,
            "total" : 222,
            "dependencies" : 36,
            "critical" : 6,
            "high" : 61,
            "medium" : 138,
            "low" : 17,
            "remediations" : 0,
            "recommendations" : 0,
            "unscanned" : 0
          },
          "dependencies" : [ {
            "ref" : "pkg:rpm/redhat/microdnf@3.9.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=microdnf-3.9.1-3.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/openssl-libs@3.0.7-16.el9_2?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=openssl-3.0.7-16.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5363",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-5363" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12797",
                "title" : "RFC7250 handshakes with unauthenticated servers don't abort as expected",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-12797" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69419",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69419" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6129",
                "title" : "POLY1305 MAC implementation corrupts vector registers on PowerPC",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6129" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69421",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69421" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-11187",
                "title" : "Improper validation of PBMAC1 parameters in PKCS#12 MAC verification",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-11187" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6237",
                "title" : "Excessive time spent checking invalid RSA public keys",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6237" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-5535",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-5535" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-6119",
                "title" : "Possible denial of service in X.509 name checks",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-6119" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15468",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15468" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-66199",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-66199" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69420",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69420" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22796",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4741",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4741" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9230",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9230" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0727",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-0727" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15469",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22795",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22795" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2975",
                "title" : "AES-SIV implementation ignores empty associated data entries",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-2975" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3446",
                "title" : "Excessive time spent checking DH keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3446" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3817",
                "title" : "Excessive time spent checking DH q parameter value",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3817" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5678",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5678" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4603",
                "title" : "Excessive time spent checking DSA keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4603" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68160",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-68160" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69418",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69418" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2511",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-2511" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libxml2@2.9.13-3.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libxml2-2.9.13-3.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-40896",
                "title" : "In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-40896" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49794",
                "title" : "Libxml: heap use after free (uaf) leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-49794" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49796",
                "title" : "Libxml: type confusion leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-49796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-56171",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-56171" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-24928",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-24928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7425",
                "title" : "Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-7425" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-25062",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-25062" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32415",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-32415" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49795",
                "title" : "Libxml: null pointer dereference leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-49795" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6021",
                "title" : "Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6021" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7424",
                "title" : "Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-7424" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-39615",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-39615" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6732",
                "title" : "Libxml2: libxml2: denial of service via crafted xsd-validated document",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6732" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9714",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9714" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-1757",
                "title" : "Libxml2: memory leak leading to local denial of service in xmllint interactive shell",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-1757" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-49043",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-49043" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28484",
                "title" : "In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-28484" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-29469",
                "title" : "An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\\0' value).",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-29469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0990",
                "title" : "Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0990" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32414",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32414" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-26434",
                "title" : "In libxml2, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-26434" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0989",
                "title" : "Libxml2: unbounded relaxng include recursion leading to stack overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0989" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0992",
                "title" : "Libxml2: libxml2: denial of service via crafted xml catalogs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0992" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6170",
                "title" : "Libxml2: stack buffer overflow in xmllint interactive shell command handling",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2025-6170" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-40896",
                "title" : "In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-40896" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ca-certificates@2022.2.54-90.2.el9_0?arch=noarch&distro=rhel-9.2&upstream=ca-certificates-2022.2.54-90.2.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/krb5-libs@1.20.1-9.el9_2?arch=x86_64&distro=rhel-9.2&upstream=krb5-1.20.1-9.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-39975",
                "title" : "kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-39975" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26462",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-26462" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37370",
                "title" : "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-37370" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-36054",
                "title" : "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-36054" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37371",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-37371" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-24528",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-24528" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26458",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26458" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26461",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26461" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-3576",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-3576" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gnupg2@2.3.3-2.el9_0?arch=x86_64&distro=rhel-9.2&upstream=gnupg2-2.3.3-2.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-24882",
                "source" : "redhat-csaf",
                "cvssScore" : 8.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-24882" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68973",
                "title" : "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-68973" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68972",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-68972" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-24882",
                "source" : "redhat-csaf",
                "cvssScore" : 8.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-24882" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/curl-minimal@7.76.1-23.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=curl-7.76.1-23.el9_2.1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2398",
                "title" : "HTTP/2 push headers memory-leak",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2398" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27536",
                "title" : "An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27536" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28321",
                "title" : "An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-28321" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27538",
                "title" : "An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27538" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-46218",
                "title" : "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-46218" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9086",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9086" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27533",
                "title" : "A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27534",
                "title" : "A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-27534" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28322",
                "title" : "An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-28322" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-38546",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-38546" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcurl-minimal@7.76.1-23.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=curl-7.76.1-23.el9_2.1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2398",
                "title" : "HTTP/2 push headers memory-leak",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2398" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27536",
                "title" : "An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27536" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28321",
                "title" : "An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-28321" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27538",
                "title" : "An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27538" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-46218",
                "title" : "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-46218" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9086",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9086" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27533",
                "title" : "A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27534",
                "title" : "A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-27534" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28322",
                "title" : "An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-28322" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-38546",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-38546" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4878",
                "title" : "Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4878" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2602",
                "title" : "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-2602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libarchive@3.5.3-4.el9?arch=x86_64&distro=rhel-9.2&upstream=libarchive-3.5.3-4.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-5914",
                "title" : "Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-5914" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4111",
                "title" : "Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-4111" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4424",
                "title" : "Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-4424" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5121",
                "title" : "Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-5121" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4426",
                "title" : "Libarchive: libarchive: denial of service via malformed iso file processing",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4426" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-60753",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-60753" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5745",
                "title" : "Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5745" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-57970",
                "title" : "libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-57970" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-25724",
                "title" : "list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-25724" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-5914",
                "title" : "Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-5914" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/sqlite-libs@3.34.1-6.el9_1?arch=x86_64&distro=rhel-9.2&upstream=sqlite-3.34.1-6.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-6965",
                "title" : "Integer Truncation on SQLite",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6965" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-7104",
                "source" : "redhat-csaf",
                "cvssScore" : 7.3,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-7104" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-3277",
                "title" : "An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.3,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-3277" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-6965",
                "title" : "Integer Truncation on SQLite",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6965" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glib2@2.68.4-6.el9?arch=x86_64&distro=rhel-9.2&upstream=glib2-2.68.4-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13601",
                "title" : "Glib: integer overflow in in g_escape_uri_string()",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-13601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-52533",
                "title" : "gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\\0' character.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-52533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-32611",
                "title" : "G_variant_byteswap() can take a long time with some non-normal inputs",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-32611" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-32665",
                "title" : "Gvariant deserialisation does not match spec for non-normal data",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-32665" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14512",
                "title" : "Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14512" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-29499",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-29499" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14087",
                "title" : "Glib: glib: buffer underflow in gvariant parser leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14087" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4373",
                "source" : "redhat-csaf",
                "cvssScore" : 4.8,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-4373" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-34397",
                "source" : "redhat-csaf",
                "cvssScore" : 3.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-34397" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7039",
                "title" : "Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2025-7039" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0988",
                "title" : "Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0988" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13601",
                "title" : "Glib: integer overflow in in g_escape_uri_string()",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-13601" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gnutls@3.7.6-20.el9_2?arch=x86_64&distro=rhel-9.2&upstream=gnutls-3.7.6-20.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0567",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0567" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-1584",
                "title" : "Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-1584" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33845",
                "title" : "Gnutls: gnutls: denial of service via dtls zero-length fragment",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33845" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33846",
                "title" : "Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33846" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32988",
                "title" : "Gnutls: vulnerability in gnutls othername san export",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32988" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32990",
                "title" : "Gnutls: vulnerability in gnutls certtool template parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32990" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6395",
                "title" : "Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-6395" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3833",
                "title" : "Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3833" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5981" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12243",
                "title" : "Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12243" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28834",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28834" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14831",
                "title" : "Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14831" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32989",
                "title" : "Gnutls: vulnerability in gnutls sct extension parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28835",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28835" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9820",
                "title" : "Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9820" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3832",
                "title" : "Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3832" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcrypt@1.10.0-10.el9_2?arch=x86_64&distro=rhel-9.2&upstream=libgcrypt-1.10.0-10.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-41989",
                "title" : "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-41989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2236",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-2236" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-41990",
                "title" : "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-41990" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-41989",
                "title" : "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-41989" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libnghttp2@1.43.0-5.el9?arch=x86_64&distro=rhel-9.2&upstream=nghttp2-1.43.0-5.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-44487",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-44487" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-27135",
                "title" : "nghttp2 Denial of service: Assertion failure due to the missing state validation",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-27135" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28182",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28182" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-44487",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-44487" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/openldap-compat@2.6.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=openldap-2.6.2-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/openldap@2.6.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=openldap-2.6.2-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/rpm@4.16.1.3-22.el9?arch=x86_64&distro=rhel-9.2&upstream=rpm-4.16.1.3-22.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35939",
                "title" : "It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35939" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35937",
                "title" : "A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35937" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/rpm-libs@4.16.1.3-22.el9?arch=x86_64&distro=rhel-9.2&upstream=rpm-4.16.1.3-22.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35939",
                "title" : "It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35939" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35937",
                "title" : "A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35937" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gmp@6.2.0-10.el9?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=gmp-6.2.0-10.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libmount@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libuuid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libblkid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-27456",
                "title" : "util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-27456" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3184",
                "title" : "Util-linux: util-linux: access control bypass due to improper hostname canonicalization",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3184" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libstdc%2B%2B@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libsmartcols@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12133",
                "title" : "Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12133" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/file-libs@5.39-12.el9?arch=x86_64&distro=rhel-9.2&upstream=file-5.39-12.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2022-48554",
                "title" : "File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: \"File\" is the name of an Open Source project.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-48554" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2022-48554",
                "title" : "File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: \"File\" is the name of an Open Source project.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-48554" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/bzip2-libs@1.0.8-8.el9?arch=x86_64&distro=rhel-9.2&upstream=bzip2-1.0.8-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2019-12900",
                "title" : "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2019-12900" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2019-12900",
                "title" : "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2019-12900" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-15467",
              "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
              "source" : "redhat-csaf",
              "cvssScore" : 9.8,
              "severity" : "CRITICAL",
              "cves" : [ "CVE-2025-15467" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/openldap-compat@2.6.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=openldap-2.6.2-3.el9.src.rpm",
            "issues" : [ {
              "id" : "CVE-2023-2953",
              "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
              "source" : "redhat-csaf",
              "cvssScore" : 7.1,
              "severity" : "HIGH",
              "cves" : [ "CVE-2023-2953" ],
              "unique" : false
            } ],
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/openssl-libs@3.0.7-16.el9_2?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=openssl-3.0.7-16.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5363",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-5363" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12797",
                "title" : "RFC7250 handshakes with unauthenticated servers don't abort as expected",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-12797" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69419",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69419" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6129",
                "title" : "POLY1305 MAC implementation corrupts vector registers on PowerPC",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6129" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69421",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69421" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-11187",
                "title" : "Improper validation of PBMAC1 parameters in PKCS#12 MAC verification",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-11187" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6237",
                "title" : "Excessive time spent checking invalid RSA public keys",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6237" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-5535",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-5535" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-6119",
                "title" : "Possible denial of service in X.509 name checks",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-6119" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15468",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15468" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-66199",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-66199" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69420",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69420" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22796",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4741",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4741" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9230",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9230" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0727",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-0727" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15469",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22795",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22795" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2975",
                "title" : "AES-SIV implementation ignores empty associated data entries",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-2975" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3446",
                "title" : "Excessive time spent checking DH keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3446" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3817",
                "title" : "Excessive time spent checking DH q parameter value",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3817" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5678",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5678" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4603",
                "title" : "Excessive time spent checking DSA keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4603" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68160",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-68160" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69418",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69418" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2511",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-2511" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ca-certificates@2022.2.54-90.2.el9_0?arch=noarch&distro=rhel-9.2&upstream=ca-certificates-2022.2.54-90.2.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/krb5-libs@1.20.1-9.el9_2?arch=x86_64&distro=rhel-9.2&upstream=krb5-1.20.1-9.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-39975",
                "title" : "kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-39975" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26462",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-26462" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37370",
                "title" : "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-37370" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-36054",
                "title" : "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-36054" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37371",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-37371" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-24528",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-24528" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26458",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26458" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26461",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26461" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-3576",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-3576" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4878",
                "title" : "Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4878" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2602",
                "title" : "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-2602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/openldap@2.6.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=openldap-2.6.2-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gmp@6.2.0-10.el9?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=gmp-6.2.0-10.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12133",
                "title" : "Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12133" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-15467",
              "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
              "source" : "redhat-csaf",
              "cvssScore" : 9.8,
              "severity" : "CRITICAL",
              "cves" : [ "CVE-2025-15467" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/systemd-libs@252-14.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=systemd-252-14.el9_2.1.src.rpm",
            "issues" : [ {
              "id" : "CVE-2026-29111",
              "title" : "systemd: Local unprivileged user can trigger an assert",
              "source" : "redhat-csaf",
              "cvssScore" : 7.8,
              "severity" : "HIGH",
              "cves" : [ "CVE-2026-29111" ],
              "unique" : false
            }, {
              "id" : "CVE-2023-7008",
              "source" : "redhat-csaf",
              "cvssScore" : 5.9,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2023-7008" ],
              "unique" : false
            }, {
              "id" : "CVE-2025-4598",
              "source" : "redhat-csaf",
              "cvssScore" : 4.7,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2025-4598" ],
              "unique" : false
            } ],
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/openssl-libs@3.0.7-16.el9_2?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=openssl-3.0.7-16.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5363",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-5363" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12797",
                "title" : "RFC7250 handshakes with unauthenticated servers don't abort as expected",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-12797" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69419",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69419" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6129",
                "title" : "POLY1305 MAC implementation corrupts vector registers on PowerPC",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6129" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69421",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69421" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-11187",
                "title" : "Improper validation of PBMAC1 parameters in PKCS#12 MAC verification",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-11187" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6237",
                "title" : "Excessive time spent checking invalid RSA public keys",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6237" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-5535",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-5535" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-6119",
                "title" : "Possible denial of service in X.509 name checks",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-6119" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15468",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15468" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-66199",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-66199" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69420",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69420" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22796",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4741",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4741" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9230",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9230" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0727",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-0727" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15469",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22795",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22795" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2975",
                "title" : "AES-SIV implementation ignores empty associated data entries",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-2975" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3446",
                "title" : "Excessive time spent checking DH keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3446" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3817",
                "title" : "Excessive time spent checking DH q parameter value",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3817" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5678",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5678" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4603",
                "title" : "Excessive time spent checking DSA keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4603" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68160",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-68160" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69418",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69418" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2511",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-2511" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ca-certificates@2022.2.54-90.2.el9_0?arch=noarch&distro=rhel-9.2&upstream=ca-certificates-2022.2.54-90.2.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4878",
                "title" : "Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4878" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2602",
                "title" : "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-2602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcrypt@1.10.0-10.el9_2?arch=x86_64&distro=rhel-9.2&upstream=libgcrypt-1.10.0-10.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-41989",
                "title" : "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-41989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2236",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-2236" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-41990",
                "title" : "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-41990" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-41989",
                "title" : "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-41989" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12133",
                "title" : "Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12133" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-15467",
              "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
              "source" : "redhat-csaf",
              "cvssScore" : 9.8,
              "severity" : "CRITICAL",
              "cves" : [ "CVE-2025-15467" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/gnupg2@2.3.3-2.el9_0?arch=x86_64&distro=rhel-9.2&upstream=gnupg2-2.3.3-2.el9_0.src.rpm",
            "issues" : [ {
              "id" : "CVE-2026-24882",
              "source" : "redhat-csaf",
              "cvssScore" : 8.4,
              "severity" : "HIGH",
              "cves" : [ "CVE-2026-24882" ],
              "unique" : false
            }, {
              "id" : "CVE-2025-68973",
              "title" : "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)",
              "source" : "redhat-csaf",
              "cvssScore" : 7.8,
              "severity" : "HIGH",
              "cves" : [ "CVE-2025-68973" ],
              "unique" : false
            }, {
              "id" : "CVE-2025-68972",
              "source" : "redhat-csaf",
              "cvssScore" : 5.9,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2025-68972" ],
              "unique" : false
            } ],
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/openssl-libs@3.0.7-16.el9_2?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=openssl-3.0.7-16.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5363",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-5363" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12797",
                "title" : "RFC7250 handshakes with unauthenticated servers don't abort as expected",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-12797" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69419",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69419" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6129",
                "title" : "POLY1305 MAC implementation corrupts vector registers on PowerPC",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6129" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69421",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69421" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-11187",
                "title" : "Improper validation of PBMAC1 parameters in PKCS#12 MAC verification",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-11187" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6237",
                "title" : "Excessive time spent checking invalid RSA public keys",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6237" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-5535",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-5535" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-6119",
                "title" : "Possible denial of service in X.509 name checks",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-6119" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15468",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15468" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-66199",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-66199" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69420",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69420" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22796",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4741",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4741" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9230",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9230" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0727",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-0727" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15469",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22795",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22795" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2975",
                "title" : "AES-SIV implementation ignores empty associated data entries",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-2975" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3446",
                "title" : "Excessive time spent checking DH keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3446" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3817",
                "title" : "Excessive time spent checking DH q parameter value",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3817" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5678",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5678" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4603",
                "title" : "Excessive time spent checking DSA keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4603" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68160",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-68160" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69418",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69418" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2511",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-2511" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ca-certificates@2022.2.54-90.2.el9_0?arch=noarch&distro=rhel-9.2&upstream=ca-certificates-2022.2.54-90.2.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/krb5-libs@1.20.1-9.el9_2?arch=x86_64&distro=rhel-9.2&upstream=krb5-1.20.1-9.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-39975",
                "title" : "kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-39975" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26462",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-26462" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37370",
                "title" : "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-37370" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-36054",
                "title" : "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-36054" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37371",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-37371" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-24528",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-24528" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26458",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26458" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26461",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26461" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-3576",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-3576" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4878",
                "title" : "Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4878" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2602",
                "title" : "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-2602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/sqlite-libs@3.34.1-6.el9_1?arch=x86_64&distro=rhel-9.2&upstream=sqlite-3.34.1-6.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-6965",
                "title" : "Integer Truncation on SQLite",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6965" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-7104",
                "source" : "redhat-csaf",
                "cvssScore" : 7.3,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-7104" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-3277",
                "title" : "An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.3,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-3277" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-6965",
                "title" : "Integer Truncation on SQLite",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6965" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gnutls@3.7.6-20.el9_2?arch=x86_64&distro=rhel-9.2&upstream=gnutls-3.7.6-20.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0567",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0567" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-1584",
                "title" : "Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-1584" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33845",
                "title" : "Gnutls: gnutls: denial of service via dtls zero-length fragment",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33845" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33846",
                "title" : "Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33846" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32988",
                "title" : "Gnutls: vulnerability in gnutls othername san export",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32988" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32990",
                "title" : "Gnutls: vulnerability in gnutls certtool template parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32990" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6395",
                "title" : "Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-6395" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3833",
                "title" : "Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3833" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5981" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12243",
                "title" : "Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12243" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28834",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28834" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14831",
                "title" : "Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14831" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32989",
                "title" : "Gnutls: vulnerability in gnutls sct extension parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28835",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28835" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9820",
                "title" : "Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9820" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3832",
                "title" : "Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3832" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcrypt@1.10.0-10.el9_2?arch=x86_64&distro=rhel-9.2&upstream=libgcrypt-1.10.0-10.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-41989",
                "title" : "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-41989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2236",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-2236" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-41990",
                "title" : "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-41990" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-41989",
                "title" : "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-41989" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/openldap-compat@2.6.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=openldap-2.6.2-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/openldap@2.6.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=openldap-2.6.2-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gmp@6.2.0-10.el9?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=gmp-6.2.0-10.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12133",
                "title" : "Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12133" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/bzip2-libs@1.0.8-8.el9?arch=x86_64&distro=rhel-9.2&upstream=bzip2-1.0.8-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2019-12900",
                "title" : "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2019-12900" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2019-12900",
                "title" : "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2019-12900" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-15467",
              "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
              "source" : "redhat-csaf",
              "cvssScore" : 9.8,
              "severity" : "CRITICAL",
              "cves" : [ "CVE-2025-15467" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/libmodulemd@2.13.0-2.el9?arch=x86_64&distro=rhel-9.2&upstream=libmodulemd-2.13.0-2.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/openssl-libs@3.0.7-16.el9_2?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=openssl-3.0.7-16.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5363",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-5363" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12797",
                "title" : "RFC7250 handshakes with unauthenticated servers don't abort as expected",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-12797" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69419",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69419" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6129",
                "title" : "POLY1305 MAC implementation corrupts vector registers on PowerPC",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6129" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69421",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69421" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-11187",
                "title" : "Improper validation of PBMAC1 parameters in PKCS#12 MAC verification",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-11187" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6237",
                "title" : "Excessive time spent checking invalid RSA public keys",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6237" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-5535",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-5535" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-6119",
                "title" : "Possible denial of service in X.509 name checks",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-6119" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15468",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15468" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-66199",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-66199" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69420",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69420" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22796",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4741",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4741" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9230",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9230" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0727",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-0727" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15469",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22795",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22795" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2975",
                "title" : "AES-SIV implementation ignores empty associated data entries",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-2975" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3446",
                "title" : "Excessive time spent checking DH keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3446" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3817",
                "title" : "Excessive time spent checking DH q parameter value",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3817" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5678",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5678" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4603",
                "title" : "Excessive time spent checking DSA keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4603" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68160",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-68160" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69418",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69418" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2511",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-2511" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libxml2@2.9.13-3.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libxml2-2.9.13-3.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-40896",
                "title" : "In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-40896" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49794",
                "title" : "Libxml: heap use after free (uaf) leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-49794" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49796",
                "title" : "Libxml: type confusion leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-49796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-56171",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-56171" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-24928",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-24928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7425",
                "title" : "Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-7425" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-25062",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-25062" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32415",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-32415" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49795",
                "title" : "Libxml: null pointer dereference leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-49795" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6021",
                "title" : "Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6021" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7424",
                "title" : "Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-7424" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-39615",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-39615" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6732",
                "title" : "Libxml2: libxml2: denial of service via crafted xsd-validated document",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6732" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9714",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9714" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-1757",
                "title" : "Libxml2: memory leak leading to local denial of service in xmllint interactive shell",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-1757" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-49043",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-49043" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28484",
                "title" : "In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-28484" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-29469",
                "title" : "An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\\0' value).",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-29469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0990",
                "title" : "Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0990" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32414",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32414" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-26434",
                "title" : "In libxml2, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-26434" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0989",
                "title" : "Libxml2: unbounded relaxng include recursion leading to stack overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0989" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0992",
                "title" : "Libxml2: libxml2: denial of service via crafted xml catalogs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0992" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6170",
                "title" : "Libxml2: stack buffer overflow in xmllint interactive shell command handling",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2025-6170" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-40896",
                "title" : "In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-40896" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ca-certificates@2022.2.54-90.2.el9_0?arch=noarch&distro=rhel-9.2&upstream=ca-certificates-2022.2.54-90.2.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/krb5-libs@1.20.1-9.el9_2?arch=x86_64&distro=rhel-9.2&upstream=krb5-1.20.1-9.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-39975",
                "title" : "kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-39975" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26462",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-26462" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37370",
                "title" : "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-37370" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-36054",
                "title" : "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-36054" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37371",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-37371" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-24528",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-24528" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26458",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26458" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26461",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26461" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-3576",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-3576" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/curl-minimal@7.76.1-23.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=curl-7.76.1-23.el9_2.1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2398",
                "title" : "HTTP/2 push headers memory-leak",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2398" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27536",
                "title" : "An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27536" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28321",
                "title" : "An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-28321" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27538",
                "title" : "An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27538" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-46218",
                "title" : "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-46218" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9086",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9086" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27533",
                "title" : "A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27534",
                "title" : "A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-27534" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28322",
                "title" : "An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-28322" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-38546",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-38546" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcurl-minimal@7.76.1-23.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=curl-7.76.1-23.el9_2.1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2398",
                "title" : "HTTP/2 push headers memory-leak",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2398" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27536",
                "title" : "An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27536" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28321",
                "title" : "An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-28321" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27538",
                "title" : "An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27538" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-46218",
                "title" : "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-46218" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9086",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9086" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27533",
                "title" : "A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27534",
                "title" : "A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-27534" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28322",
                "title" : "An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-28322" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-38546",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-38546" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4878",
                "title" : "Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4878" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2602",
                "title" : "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-2602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libarchive@3.5.3-4.el9?arch=x86_64&distro=rhel-9.2&upstream=libarchive-3.5.3-4.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-5914",
                "title" : "Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-5914" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4111",
                "title" : "Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-4111" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4424",
                "title" : "Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-4424" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5121",
                "title" : "Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-5121" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4426",
                "title" : "Libarchive: libarchive: denial of service via malformed iso file processing",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4426" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-60753",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-60753" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5745",
                "title" : "Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5745" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-57970",
                "title" : "libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-57970" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-25724",
                "title" : "list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-25724" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-5914",
                "title" : "Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-5914" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/sqlite-libs@3.34.1-6.el9_1?arch=x86_64&distro=rhel-9.2&upstream=sqlite-3.34.1-6.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-6965",
                "title" : "Integer Truncation on SQLite",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6965" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-7104",
                "source" : "redhat-csaf",
                "cvssScore" : 7.3,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-7104" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-3277",
                "title" : "An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.3,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-3277" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-6965",
                "title" : "Integer Truncation on SQLite",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6965" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glib2@2.68.4-6.el9?arch=x86_64&distro=rhel-9.2&upstream=glib2-2.68.4-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13601",
                "title" : "Glib: integer overflow in in g_escape_uri_string()",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-13601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-52533",
                "title" : "gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\\0' character.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-52533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-32611",
                "title" : "G_variant_byteswap() can take a long time with some non-normal inputs",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-32611" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-32665",
                "title" : "Gvariant deserialisation does not match spec for non-normal data",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-32665" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14512",
                "title" : "Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14512" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-29499",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-29499" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14087",
                "title" : "Glib: glib: buffer underflow in gvariant parser leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14087" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4373",
                "source" : "redhat-csaf",
                "cvssScore" : 4.8,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-4373" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-34397",
                "source" : "redhat-csaf",
                "cvssScore" : 3.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-34397" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7039",
                "title" : "Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2025-7039" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0988",
                "title" : "Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0988" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13601",
                "title" : "Glib: integer overflow in in g_escape_uri_string()",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-13601" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gnutls@3.7.6-20.el9_2?arch=x86_64&distro=rhel-9.2&upstream=gnutls-3.7.6-20.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0567",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0567" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-1584",
                "title" : "Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-1584" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33845",
                "title" : "Gnutls: gnutls: denial of service via dtls zero-length fragment",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33845" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33846",
                "title" : "Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33846" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32988",
                "title" : "Gnutls: vulnerability in gnutls othername san export",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32988" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32990",
                "title" : "Gnutls: vulnerability in gnutls certtool template parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32990" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6395",
                "title" : "Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-6395" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3833",
                "title" : "Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3833" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5981" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12243",
                "title" : "Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12243" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28834",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28834" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14831",
                "title" : "Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14831" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32989",
                "title" : "Gnutls: vulnerability in gnutls sct extension parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28835",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28835" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9820",
                "title" : "Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9820" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3832",
                "title" : "Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3832" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libnghttp2@1.43.0-5.el9?arch=x86_64&distro=rhel-9.2&upstream=nghttp2-1.43.0-5.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-44487",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-44487" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-27135",
                "title" : "nghttp2 Denial of service: Assertion failure due to the missing state validation",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-27135" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28182",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28182" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-44487",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-44487" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/rpm@4.16.1.3-22.el9?arch=x86_64&distro=rhel-9.2&upstream=rpm-4.16.1.3-22.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35939",
                "title" : "It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35939" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35937",
                "title" : "A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35937" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/rpm-libs@4.16.1.3-22.el9?arch=x86_64&distro=rhel-9.2&upstream=rpm-4.16.1.3-22.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35939",
                "title" : "It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35939" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35937",
                "title" : "A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35937" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gmp@6.2.0-10.el9?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=gmp-6.2.0-10.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libmount@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libuuid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libblkid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-27456",
                "title" : "util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-27456" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3184",
                "title" : "Util-linux: util-linux: access control bypass due to improper hostname canonicalization",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3184" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12133",
                "title" : "Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12133" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/file-libs@5.39-12.el9?arch=x86_64&distro=rhel-9.2&upstream=file-5.39-12.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2022-48554",
                "title" : "File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: \"File\" is the name of an Open Source project.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-48554" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2022-48554",
                "title" : "File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: \"File\" is the name of an Open Source project.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-48554" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/bzip2-libs@1.0.8-8.el9?arch=x86_64&distro=rhel-9.2&upstream=bzip2-1.0.8-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2019-12900",
                "title" : "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2019-12900" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2019-12900",
                "title" : "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2019-12900" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-15467",
              "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
              "source" : "redhat-csaf",
              "cvssScore" : 9.8,
              "severity" : "CRITICAL",
              "cves" : [ "CVE-2025-15467" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/libusbx@1.0.26-1.el9?arch=x86_64&distro=rhel-9.2&upstream=libusbx-1.0.26-1.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/openssl-libs@3.0.7-16.el9_2?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=openssl-3.0.7-16.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5363",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-5363" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12797",
                "title" : "RFC7250 handshakes with unauthenticated servers don't abort as expected",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-12797" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69419",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69419" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6129",
                "title" : "POLY1305 MAC implementation corrupts vector registers on PowerPC",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6129" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69421",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69421" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-11187",
                "title" : "Improper validation of PBMAC1 parameters in PKCS#12 MAC verification",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-11187" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6237",
                "title" : "Excessive time spent checking invalid RSA public keys",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6237" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-5535",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-5535" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-6119",
                "title" : "Possible denial of service in X.509 name checks",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-6119" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15468",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15468" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-66199",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-66199" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69420",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69420" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22796",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4741",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4741" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9230",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9230" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0727",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-0727" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15469",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22795",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22795" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2975",
                "title" : "AES-SIV implementation ignores empty associated data entries",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-2975" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3446",
                "title" : "Excessive time spent checking DH keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3446" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3817",
                "title" : "Excessive time spent checking DH q parameter value",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3817" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5678",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5678" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4603",
                "title" : "Excessive time spent checking DSA keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4603" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68160",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-68160" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69418",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69418" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2511",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-2511" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ca-certificates@2022.2.54-90.2.el9_0?arch=noarch&distro=rhel-9.2&upstream=ca-certificates-2022.2.54-90.2.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4878",
                "title" : "Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4878" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2602",
                "title" : "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-2602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/systemd-libs@252-14.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=systemd-252-14.el9_2.1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-29111",
                "title" : "systemd: Local unprivileged user can trigger an assert",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-29111" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-7008",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-7008" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4598",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-4598" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-29111",
                "title" : "systemd: Local unprivileged user can trigger an assert",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-29111" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcrypt@1.10.0-10.el9_2?arch=x86_64&distro=rhel-9.2&upstream=libgcrypt-1.10.0-10.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-41989",
                "title" : "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-41989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2236",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-2236" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-41990",
                "title" : "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-41990" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-41989",
                "title" : "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-41989" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12133",
                "title" : "Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12133" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-15467",
              "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
              "source" : "redhat-csaf",
              "cvssScore" : 9.8,
              "severity" : "CRITICAL",
              "cves" : [ "CVE-2025-15467" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/rpm-libs@4.16.1.3-22.el9?arch=x86_64&distro=rhel-9.2&upstream=rpm-4.16.1.3-22.el9.src.rpm",
            "issues" : [ {
              "id" : "CVE-2021-35938",
              "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
              "source" : "redhat-csaf",
              "cvssScore" : 6.5,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2021-35938" ],
              "unique" : false
            }, {
              "id" : "CVE-2021-35939",
              "title" : "It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
              "source" : "redhat-csaf",
              "cvssScore" : 6.5,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2021-35939" ],
              "unique" : false
            }, {
              "id" : "CVE-2021-35937",
              "title" : "A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
              "source" : "redhat-csaf",
              "cvssScore" : 6.3,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2021-35937" ],
              "unique" : false
            } ],
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/openssl-libs@3.0.7-16.el9_2?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=openssl-3.0.7-16.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5363",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-5363" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12797",
                "title" : "RFC7250 handshakes with unauthenticated servers don't abort as expected",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-12797" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69419",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69419" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6129",
                "title" : "POLY1305 MAC implementation corrupts vector registers on PowerPC",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6129" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69421",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69421" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-11187",
                "title" : "Improper validation of PBMAC1 parameters in PKCS#12 MAC verification",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-11187" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6237",
                "title" : "Excessive time spent checking invalid RSA public keys",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6237" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-5535",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-5535" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-6119",
                "title" : "Possible denial of service in X.509 name checks",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-6119" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15468",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15468" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-66199",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-66199" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69420",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69420" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22796",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4741",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4741" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9230",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9230" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0727",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-0727" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15469",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22795",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22795" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2975",
                "title" : "AES-SIV implementation ignores empty associated data entries",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-2975" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3446",
                "title" : "Excessive time spent checking DH keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3446" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3817",
                "title" : "Excessive time spent checking DH q parameter value",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3817" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5678",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5678" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4603",
                "title" : "Excessive time spent checking DSA keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4603" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68160",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-68160" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69418",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69418" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2511",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-2511" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libxml2@2.9.13-3.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libxml2-2.9.13-3.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-40896",
                "title" : "In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-40896" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49794",
                "title" : "Libxml: heap use after free (uaf) leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-49794" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49796",
                "title" : "Libxml: type confusion leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-49796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-56171",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-56171" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-24928",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-24928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7425",
                "title" : "Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-7425" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-25062",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-25062" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32415",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-32415" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49795",
                "title" : "Libxml: null pointer dereference leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-49795" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6021",
                "title" : "Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6021" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7424",
                "title" : "Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-7424" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-39615",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-39615" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6732",
                "title" : "Libxml2: libxml2: denial of service via crafted xsd-validated document",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6732" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9714",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9714" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-1757",
                "title" : "Libxml2: memory leak leading to local denial of service in xmllint interactive shell",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-1757" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-49043",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-49043" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28484",
                "title" : "In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-28484" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-29469",
                "title" : "An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\\0' value).",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-29469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0990",
                "title" : "Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0990" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32414",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32414" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-26434",
                "title" : "In libxml2, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-26434" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0989",
                "title" : "Libxml2: unbounded relaxng include recursion leading to stack overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0989" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0992",
                "title" : "Libxml2: libxml2: denial of service via crafted xml catalogs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0992" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6170",
                "title" : "Libxml2: stack buffer overflow in xmllint interactive shell command handling",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2025-6170" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-40896",
                "title" : "In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-40896" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ca-certificates@2022.2.54-90.2.el9_0?arch=noarch&distro=rhel-9.2&upstream=ca-certificates-2022.2.54-90.2.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/krb5-libs@1.20.1-9.el9_2?arch=x86_64&distro=rhel-9.2&upstream=krb5-1.20.1-9.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-39975",
                "title" : "kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-39975" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26462",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-26462" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37370",
                "title" : "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-37370" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-36054",
                "title" : "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-36054" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37371",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-37371" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-24528",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-24528" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26458",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26458" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26461",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26461" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-3576",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-3576" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/curl-minimal@7.76.1-23.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=curl-7.76.1-23.el9_2.1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2398",
                "title" : "HTTP/2 push headers memory-leak",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2398" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27536",
                "title" : "An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27536" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28321",
                "title" : "An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-28321" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27538",
                "title" : "An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27538" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-46218",
                "title" : "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-46218" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9086",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9086" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27533",
                "title" : "A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27534",
                "title" : "A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-27534" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28322",
                "title" : "An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-28322" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-38546",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-38546" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcurl-minimal@7.76.1-23.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=curl-7.76.1-23.el9_2.1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2398",
                "title" : "HTTP/2 push headers memory-leak",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2398" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27536",
                "title" : "An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27536" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28321",
                "title" : "An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-28321" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27538",
                "title" : "An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27538" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-46218",
                "title" : "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-46218" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9086",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9086" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27533",
                "title" : "A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27534",
                "title" : "A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-27534" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28322",
                "title" : "An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-28322" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-38546",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-38546" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4878",
                "title" : "Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4878" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2602",
                "title" : "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-2602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libarchive@3.5.3-4.el9?arch=x86_64&distro=rhel-9.2&upstream=libarchive-3.5.3-4.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-5914",
                "title" : "Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-5914" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4111",
                "title" : "Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-4111" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4424",
                "title" : "Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-4424" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5121",
                "title" : "Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-5121" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4426",
                "title" : "Libarchive: libarchive: denial of service via malformed iso file processing",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4426" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-60753",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-60753" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5745",
                "title" : "Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5745" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-57970",
                "title" : "libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-57970" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-25724",
                "title" : "list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-25724" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-5914",
                "title" : "Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-5914" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/sqlite-libs@3.34.1-6.el9_1?arch=x86_64&distro=rhel-9.2&upstream=sqlite-3.34.1-6.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-6965",
                "title" : "Integer Truncation on SQLite",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6965" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-7104",
                "source" : "redhat-csaf",
                "cvssScore" : 7.3,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-7104" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-3277",
                "title" : "An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.3,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-3277" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-6965",
                "title" : "Integer Truncation on SQLite",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6965" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libnghttp2@1.43.0-5.el9?arch=x86_64&distro=rhel-9.2&upstream=nghttp2-1.43.0-5.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-44487",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-44487" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-27135",
                "title" : "nghttp2 Denial of service: Assertion failure due to the missing state validation",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-27135" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28182",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28182" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-44487",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-44487" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/rpm@4.16.1.3-22.el9?arch=x86_64&distro=rhel-9.2&upstream=rpm-4.16.1.3-22.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35939",
                "title" : "It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35939" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35937",
                "title" : "A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35937" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/rpm-libs@4.16.1.3-22.el9?arch=x86_64&distro=rhel-9.2&upstream=rpm-4.16.1.3-22.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35939",
                "title" : "It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35939" ],
                "unique" : false
              }, {
                "id" : "CVE-2021-35937",
                "title" : "A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35937" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-35938",
                "title" : "A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-35938" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gmp@6.2.0-10.el9?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=gmp-6.2.0-10.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12133",
                "title" : "Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12133" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/bzip2-libs@1.0.8-8.el9?arch=x86_64&distro=rhel-9.2&upstream=bzip2-1.0.8-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2019-12900",
                "title" : "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2019-12900" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2019-12900",
                "title" : "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2019-12900" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-15467",
              "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
              "source" : "redhat-csaf",
              "cvssScore" : 9.8,
              "severity" : "CRITICAL",
              "cves" : [ "CVE-2025-15467" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/librepo@1.14.5-1.el9?arch=x86_64&distro=rhel-9.2&upstream=librepo-1.14.5-1.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/openssl-libs@3.0.7-16.el9_2?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=openssl-3.0.7-16.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5363",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-5363" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12797",
                "title" : "RFC7250 handshakes with unauthenticated servers don't abort as expected",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-12797" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69419",
                "source" : "redhat-csaf",
                "cvssScore" : 7.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69419" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6129",
                "title" : "POLY1305 MAC implementation corrupts vector registers on PowerPC",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6129" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69421",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69421" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-11187",
                "title" : "Improper validation of PBMAC1 parameters in PKCS#12 MAC verification",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-11187" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-6237",
                "title" : "Excessive time spent checking invalid RSA public keys",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-6237" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-5535",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-5535" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-6119",
                "title" : "Possible denial of service in X.509 name checks",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-6119" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15468",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15468" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-66199",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-66199" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69420",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69420" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22796",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4741",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4741" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9230",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9230" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0727",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-0727" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15469",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-22795",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-22795" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2975",
                "title" : "AES-SIV implementation ignores empty associated data entries",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-2975" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3446",
                "title" : "Excessive time spent checking DH keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3446" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-3817",
                "title" : "Excessive time spent checking DH q parameter value",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-3817" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5678",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5678" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-4603",
                "title" : "Excessive time spent checking DSA keys and parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-4603" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68160",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-68160" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69418",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-69418" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2511",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-2511" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-15467",
                "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 9.8,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-15467" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libxml2@2.9.13-3.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libxml2-2.9.13-3.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-40896",
                "title" : "In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-40896" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49794",
                "title" : "Libxml: heap use after free (uaf) leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-49794" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49796",
                "title" : "Libxml: type confusion leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2025-49796" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-56171",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-56171" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-24928",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-24928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7425",
                "title" : "Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-7425" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-25062",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-25062" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32415",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-32415" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-49795",
                "title" : "Libxml: null pointer dereference leads to denial of service (dos)",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-49795" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6021",
                "title" : "Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6021" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7424",
                "title" : "Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-7424" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-39615",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-39615" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6732",
                "title" : "Libxml2: libxml2: denial of service via crafted xsd-validated document",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6732" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9714",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9714" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-1757",
                "title" : "Libxml2: memory leak leading to local denial of service in xmllint interactive shell",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-1757" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-49043",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-49043" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28484",
                "title" : "In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-28484" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-29469",
                "title" : "An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\\0' value).",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-29469" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0990",
                "title" : "Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0990" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32414",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32414" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-26434",
                "title" : "In libxml2, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-26434" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0989",
                "title" : "Libxml2: unbounded relaxng include recursion leading to stack overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0989" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0992",
                "title" : "Libxml2: libxml2: denial of service via crafted xml catalogs",
                "source" : "redhat-csaf",
                "cvssScore" : 2.9,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0992" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6170",
                "title" : "Libxml2: stack buffer overflow in xmllint interactive shell command handling",
                "source" : "redhat-csaf",
                "cvssScore" : 2.5,
                "severity" : "LOW",
                "cves" : [ "CVE-2025-6170" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-40896",
                "title" : "In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-40896" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ca-certificates@2022.2.54-90.2.el9_0?arch=noarch&distro=rhel-9.2&upstream=ca-certificates-2022.2.54-90.2.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-37920",
                "title" : "Certifi's removal of e-Tugra root certificate",
                "source" : "redhat-csaf",
                "cvssScore" : 9.1,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2023-37920" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/krb5-libs@1.20.1-9.el9_2?arch=x86_64&distro=rhel-9.2&upstream=krb5-1.20.1-9.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-39975",
                "title" : "kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-39975" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26462",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-26462" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37370",
                "title" : "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-37370" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-36054",
                "title" : "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-36054" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-37371",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-37371" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-24528",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-24528" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26458",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26458" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-26461",
                "title" : "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-26461" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-3576",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-3576" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-3596",
                "source" : "redhat-csaf",
                "cvssScore" : 9.0,
                "severity" : "CRITICAL",
                "cves" : [ "CVE-2024-3596" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gnupg2@2.3.3-2.el9_0?arch=x86_64&distro=rhel-9.2&upstream=gnupg2-2.3.3-2.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-24882",
                "source" : "redhat-csaf",
                "cvssScore" : 8.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-24882" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68973",
                "title" : "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-68973" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-68972",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-68972" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-24882",
                "source" : "redhat-csaf",
                "cvssScore" : 8.4,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-24882" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcurl-minimal@7.76.1-23.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=curl-7.76.1-23.el9_2.1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2398",
                "title" : "HTTP/2 push headers memory-leak",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2398" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27536",
                "title" : "An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27536" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28321",
                "title" : "An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-28321" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27538",
                "title" : "An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27538" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-46218",
                "title" : "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-46218" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9086",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9086" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27533",
                "title" : "A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-27533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-27534",
                "title" : "A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-27534" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-28322",
                "title" : "An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-28322" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-38546",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-38546" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-38545",
                "title" : "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-38545" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4878",
                "title" : "Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4878" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2602",
                "title" : "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-2602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/sqlite-libs@3.34.1-6.el9_1?arch=x86_64&distro=rhel-9.2&upstream=sqlite-3.34.1-6.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-6965",
                "title" : "Integer Truncation on SQLite",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6965" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-7104",
                "source" : "redhat-csaf",
                "cvssScore" : 7.3,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-7104" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-3277",
                "title" : "An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.3,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-3277" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-6965",
                "title" : "Integer Truncation on SQLite",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-6965" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glib2@2.68.4-6.el9?arch=x86_64&distro=rhel-9.2&upstream=glib2-2.68.4-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13601",
                "title" : "Glib: integer overflow in in g_escape_uri_string()",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-13601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-52533",
                "title" : "gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\\0' character.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-52533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-32611",
                "title" : "G_variant_byteswap() can take a long time with some non-normal inputs",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-32611" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-32665",
                "title" : "Gvariant deserialisation does not match spec for non-normal data",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-32665" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14512",
                "title" : "Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14512" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-29499",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-29499" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14087",
                "title" : "Glib: glib: buffer underflow in gvariant parser leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14087" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4373",
                "source" : "redhat-csaf",
                "cvssScore" : 4.8,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-4373" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-34397",
                "source" : "redhat-csaf",
                "cvssScore" : 3.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-34397" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7039",
                "title" : "Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2025-7039" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0988",
                "title" : "Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0988" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13601",
                "title" : "Glib: integer overflow in in g_escape_uri_string()",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-13601" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-31115",
                "title" : "XZ has a heap-use-after-free bug in threaded .xz decoder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-31115" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gnutls@3.7.6-20.el9_2?arch=x86_64&distro=rhel-9.2&upstream=gnutls-3.7.6-20.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0567",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0567" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-1584",
                "title" : "Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-1584" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33845",
                "title" : "Gnutls: gnutls: denial of service via dtls zero-length fragment",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33845" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33846",
                "title" : "Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33846" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32988",
                "title" : "Gnutls: vulnerability in gnutls othername san export",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32988" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32990",
                "title" : "Gnutls: vulnerability in gnutls certtool template parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32990" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6395",
                "title" : "Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-6395" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3833",
                "title" : "Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3833" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5981" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12243",
                "title" : "Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12243" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28834",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28834" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14831",
                "title" : "Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14831" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32989",
                "title" : "Gnutls: vulnerability in gnutls sct extension parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28835",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28835" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9820",
                "title" : "Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9820" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3832",
                "title" : "Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3832" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcrypt@1.10.0-10.el9_2?arch=x86_64&distro=rhel-9.2&upstream=libgcrypt-1.10.0-10.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-41989",
                "title" : "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-41989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-2236",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-2236" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-41990",
                "title" : "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-41990" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-41989",
                "title" : "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-41989" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libnghttp2@1.43.0-5.el9?arch=x86_64&distro=rhel-9.2&upstream=nghttp2-1.43.0-5.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-44487",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-44487" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-27135",
                "title" : "nghttp2 Denial of service: Assertion failure due to the missing state validation",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-27135" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28182",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28182" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-44487",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-44487" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/openldap-compat@2.6.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=openldap-2.6.2-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/openldap@2.6.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=openldap-2.6.2-3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2953",
                "title" : "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2953" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gmp@6.2.0-10.el9?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=gmp-6.2.0-10.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libmount@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libuuid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libblkid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-27456",
                "title" : "util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-27456" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3184",
                "title" : "Util-linux: util-linux: access control bypass due to improper hostname canonicalization",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3184" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12133",
                "title" : "Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12133" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/bzip2-libs@1.0.8-8.el9?arch=x86_64&distro=rhel-9.2&upstream=bzip2-1.0.8-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2019-12900",
                "title" : "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2019-12900" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2019-12900",
                "title" : "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
                "source" : "redhat-csaf",
                "cvssScore" : 4.4,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2019-12900" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2025-15467",
              "title" : "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
              "source" : "redhat-csaf",
              "cvssScore" : 9.8,
              "severity" : "CRITICAL",
              "cves" : [ "CVE-2025-15467" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/json-c@0.14-11.el9?arch=x86_64&distro=rhel-9.2&upstream=json-c-0.14-11.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2024-2961",
              "source" : "redhat-csaf",
              "cvssScore" : 8.8,
              "severity" : "HIGH",
              "cves" : [ "CVE-2024-2961" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/rootfiles@8.1-31.el9?arch=noarch&distro=rhel-9.2&upstream=rootfiles-8.1-31.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2024-2961",
              "source" : "redhat-csaf",
              "cvssScore" : 8.8,
              "severity" : "HIGH",
              "cves" : [ "CVE-2024-2961" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/json-glib@1.6.6-1.el9?arch=x86_64&distro=rhel-9.2&upstream=json-glib-1.6.6-1.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4878",
                "title" : "Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4878" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2602",
                "title" : "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-2602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glib2@2.68.4-6.el9?arch=x86_64&distro=rhel-9.2&upstream=glib2-2.68.4-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13601",
                "title" : "Glib: integer overflow in in g_escape_uri_string()",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-13601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-52533",
                "title" : "gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\\0' character.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-52533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-32611",
                "title" : "G_variant_byteswap() can take a long time with some non-normal inputs",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-32611" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-32665",
                "title" : "Gvariant deserialisation does not match spec for non-normal data",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-32665" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14512",
                "title" : "Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14512" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-29499",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-29499" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14087",
                "title" : "Glib: glib: buffer underflow in gvariant parser leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14087" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4373",
                "source" : "redhat-csaf",
                "cvssScore" : 4.8,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-4373" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-34397",
                "source" : "redhat-csaf",
                "cvssScore" : 3.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-34397" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7039",
                "title" : "Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2025-7039" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0988",
                "title" : "Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0988" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13601",
                "title" : "Glib: integer overflow in in g_escape_uri_string()",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-13601" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gnutls@3.7.6-20.el9_2?arch=x86_64&distro=rhel-9.2&upstream=gnutls-3.7.6-20.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0567",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0567" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-1584",
                "title" : "Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-1584" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33845",
                "title" : "Gnutls: gnutls: denial of service via dtls zero-length fragment",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33845" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33846",
                "title" : "Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33846" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32988",
                "title" : "Gnutls: vulnerability in gnutls othername san export",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32988" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32990",
                "title" : "Gnutls: vulnerability in gnutls certtool template parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32990" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6395",
                "title" : "Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-6395" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3833",
                "title" : "Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3833" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5981" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12243",
                "title" : "Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12243" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28834",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28834" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14831",
                "title" : "Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14831" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32989",
                "title" : "Gnutls: vulnerability in gnutls sct extension parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28835",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28835" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9820",
                "title" : "Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9820" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3832",
                "title" : "Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3832" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libuuid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libmount@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libblkid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-27456",
                "title" : "util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-27456" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3184",
                "title" : "Util-linux: util-linux: access control bypass due to improper hostname canonicalization",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3184" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12133",
                "title" : "Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12133" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2024-2961",
              "source" : "redhat-csaf",
              "cvssScore" : 8.8,
              "severity" : "HIGH",
              "cves" : [ "CVE-2024-2961" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/glib2@2.68.4-6.el9?arch=x86_64&distro=rhel-9.2&upstream=glib2-2.68.4-6.el9.src.rpm",
            "issues" : [ {
              "id" : "CVE-2025-13601",
              "title" : "Glib: integer overflow in in g_escape_uri_string()",
              "source" : "redhat-csaf",
              "cvssScore" : 7.7,
              "severity" : "HIGH",
              "cves" : [ "CVE-2025-13601" ],
              "unique" : false
            }, {
              "id" : "CVE-2024-52533",
              "title" : "gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\\0' character.",
              "source" : "redhat-csaf",
              "cvssScore" : 7.0,
              "severity" : "HIGH",
              "cves" : [ "CVE-2024-52533" ],
              "unique" : false
            }, {
              "id" : "CVE-2023-32611",
              "title" : "G_variant_byteswap() can take a long time with some non-normal inputs",
              "source" : "redhat-csaf",
              "cvssScore" : 6.5,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2023-32611" ],
              "unique" : false
            }, {
              "id" : "CVE-2023-32665",
              "title" : "Gvariant deserialisation does not match spec for non-normal data",
              "source" : "redhat-csaf",
              "cvssScore" : 6.5,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2023-32665" ],
              "unique" : false
            }, {
              "id" : "CVE-2025-14512",
              "title" : "Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow",
              "source" : "redhat-csaf",
              "cvssScore" : 6.5,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2025-14512" ],
              "unique" : false
            }, {
              "id" : "CVE-2023-29499",
              "source" : "redhat-csaf",
              "cvssScore" : 6.2,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2023-29499" ],
              "unique" : false
            }, {
              "id" : "CVE-2025-14087",
              "title" : "Glib: glib: buffer underflow in gvariant parser leads to heap corruption",
              "source" : "redhat-csaf",
              "cvssScore" : 5.6,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2025-14087" ],
              "unique" : false
            }, {
              "id" : "CVE-2025-4373",
              "source" : "redhat-csaf",
              "cvssScore" : 4.8,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2025-4373" ],
              "unique" : false
            }, {
              "id" : "CVE-2024-34397",
              "source" : "redhat-csaf",
              "cvssScore" : 3.8,
              "severity" : "LOW",
              "cves" : [ "CVE-2024-34397" ],
              "unique" : false
            }, {
              "id" : "CVE-2025-7039",
              "title" : "Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()",
              "source" : "redhat-csaf",
              "cvssScore" : 3.7,
              "severity" : "LOW",
              "cves" : [ "CVE-2025-7039" ],
              "unique" : false
            }, {
              "id" : "CVE-2026-0988",
              "title" : "Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()",
              "source" : "redhat-csaf",
              "cvssScore" : 3.7,
              "severity" : "LOW",
              "cves" : [ "CVE-2026-0988" ],
              "unique" : false
            } ],
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4878",
                "title" : "Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4878" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2602",
                "title" : "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-2602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gnutls@3.7.6-20.el9_2?arch=x86_64&distro=rhel-9.2&upstream=gnutls-3.7.6-20.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0567",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0567" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-1584",
                "title" : "Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-1584" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33845",
                "title" : "Gnutls: gnutls: denial of service via dtls zero-length fragment",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33845" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33846",
                "title" : "Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33846" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32988",
                "title" : "Gnutls: vulnerability in gnutls othername san export",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32988" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32990",
                "title" : "Gnutls: vulnerability in gnutls certtool template parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32990" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6395",
                "title" : "Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-6395" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3833",
                "title" : "Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3833" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5981" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12243",
                "title" : "Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12243" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28834",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28834" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14831",
                "title" : "Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14831" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32989",
                "title" : "Gnutls: vulnerability in gnutls sct extension parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28835",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28835" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9820",
                "title" : "Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9820" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3832",
                "title" : "Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3832" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libuuid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libmount@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libblkid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-27456",
                "title" : "util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-27456" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3184",
                "title" : "Util-linux: util-linux: access control bypass due to improper hostname canonicalization",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3184" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12133",
                "title" : "Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12133" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2024-2961",
              "source" : "redhat-csaf",
              "cvssScore" : 8.8,
              "severity" : "HIGH",
              "cves" : [ "CVE-2024-2961" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/libunistring@0.9.10-15.el9?arch=x86_64&distro=rhel-9.2&upstream=libunistring-0.9.10-15.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2024-2961",
              "source" : "redhat-csaf",
              "cvssScore" : 8.8,
              "severity" : "HIGH",
              "cves" : [ "CVE-2024-2961" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=rhel-9.2&upstream=gawk-5.1.0-6.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gmp@6.2.0-10.el9?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=gmp-6.2.0-10.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2021-43618",
                "title" : "GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2021-43618" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2024-2961",
              "source" : "redhat-csaf",
              "cvssScore" : 8.8,
              "severity" : "HIGH",
              "cves" : [ "CVE-2024-2961" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/libsmartcols@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
            "issues" : [ {
              "id" : "CVE-2025-14104",
              "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
              "source" : "redhat-csaf",
              "cvssScore" : 6.1,
              "severity" : "MEDIUM",
              "cves" : [ "CVE-2025-14104" ],
              "unique" : false
            } ],
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2024-2961",
              "source" : "redhat-csaf",
              "cvssScore" : 8.8,
              "severity" : "HIGH",
              "cves" : [ "CVE-2024-2961" ],
              "unique" : false
            }
          }, {
            "ref" : "pkg:rpm/redhat/libpeas@1.30.0-4.el9?arch=x86_64&distro=rhel-9.2&upstream=libpeas-1.30.0-4.el9.src.rpm",
            "transitive" : [ {
              "ref" : "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4437",
                "title" : "gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4437" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-6238",
                "title" : "Buffer overread in ns_printrrf with corrupted RDATA field",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-6238" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-15281",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-15281" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3904",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3904" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5435",
                "title" : "Potential buffer overflow in ns_sprintrrf TSIG handling path",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5435" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4046",
                "title" : "iconv crash due to assertion failure with untrusted input",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4046" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5450",
                "title" : "scanf %mc off-by-one heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5450" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-5928",
                "title" : "Potential buffer under-read in ungetwc",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-5928" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4438",
                "title" : "gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4438" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0861",
                "title" : "Integer overflow in memalign leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 8.1,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-0861" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4911",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-4911" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33599",
                "title" : "nscd: Stack-based buffer overflow in netgroup cache",
                "source" : "redhat-csaf",
                "cvssScore" : 7.6,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-33599" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4802",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-4802" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4527",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4527" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4806",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4806" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-4813",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-4813" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-5702",
                "title" : "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-5702" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-0395",
                "title" : "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
                "source" : "redhat-csaf",
                "cvssScore" : 5.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-0395" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33600",
                "title" : "nscd: Null pointer crashes after notfound response",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33600" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0915",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-0915" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-8058",
                "source" : "redhat-csaf",
                "cvssScore" : 4.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-8058" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33601",
                "title" : "nscd: netgroup cache may terminate daemon on memory allocation failure",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-33602",
                "title" : "nscd: netgroup cache assumes NSS callback uses in-buffer strings",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-33602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-2961",
                "source" : "redhat-csaf",
                "cvssScore" : 8.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-2961" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-4878",
                "title" : "Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-4878" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-2602",
                "title" : "A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.",
                "source" : "redhat-csaf",
                "cvssScore" : 3.3,
                "severity" : "LOW",
                "cves" : [ "CVE-2023-2602" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-2603",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-2603" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-69720",
                "title" : "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-69720" ],
                "unique" : false
              }, {
                "id" : "CVE-2022-29458",
                "title" : "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2022-29458" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2023-29491",
                "source" : "redhat-csaf",
                "cvssScore" : 7.8,
                "severity" : "HIGH",
                "cves" : [ "CVE-2023-29491" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/glib2@2.68.4-6.el9?arch=x86_64&distro=rhel-9.2&upstream=glib2-2.68.4-6.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13601",
                "title" : "Glib: integer overflow in in g_escape_uri_string()",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-13601" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-52533",
                "title" : "gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\\0' character.",
                "source" : "redhat-csaf",
                "cvssScore" : 7.0,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-52533" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-32611",
                "title" : "G_variant_byteswap() can take a long time with some non-normal inputs",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-32611" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-32665",
                "title" : "Gvariant deserialisation does not match spec for non-normal data",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-32665" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14512",
                "title" : "Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14512" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-29499",
                "source" : "redhat-csaf",
                "cvssScore" : 6.2,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-29499" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14087",
                "title" : "Glib: glib: buffer underflow in gvariant parser leads to heap corruption",
                "source" : "redhat-csaf",
                "cvssScore" : 5.6,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14087" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-4373",
                "source" : "redhat-csaf",
                "cvssScore" : 4.8,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-4373" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-34397",
                "source" : "redhat-csaf",
                "cvssScore" : 3.8,
                "severity" : "LOW",
                "cves" : [ "CVE-2024-34397" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-7039",
                "title" : "Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2025-7039" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-0988",
                "title" : "Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-0988" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13601",
                "title" : "Glib: integer overflow in in g_escape_uri_string()",
                "source" : "redhat-csaf",
                "cvssScore" : 7.7,
                "severity" : "HIGH",
                "cves" : [ "CVE-2025-13601" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/gnutls@3.7.6-20.el9_2?arch=x86_64&distro=rhel-9.2&upstream=gnutls-3.7.6-20.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-0567",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0567" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-1584",
                "title" : "Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-1584" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33845",
                "title" : "Gnutls: gnutls: denial of service via dtls zero-length fragment",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33845" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-33846",
                "title" : "Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2026-33846" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32988",
                "title" : "Gnutls: vulnerability in gnutls othername san export",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32988" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32990",
                "title" : "Gnutls: vulnerability in gnutls certtool template parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32990" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-6395",
                "title" : "Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-6395" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3833",
                "title" : "Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison",
                "source" : "redhat-csaf",
                "cvssScore" : 6.5,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-3833" ],
                "unique" : false
              }, {
                "id" : "CVE-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2023-5981" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12243",
                "title" : "Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12243" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28834",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28834" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-14831",
                "title" : "Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14831" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-32989",
                "title" : "Gnutls: vulnerability in gnutls sct extension parsing",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-32989" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-28835",
                "source" : "redhat-csaf",
                "cvssScore" : 5.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-28835" ],
                "unique" : false
              }, {
                "id" : "CVE-2025-9820",
                "title" : "Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function",
                "source" : "redhat-csaf",
                "cvssScore" : 4.0,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-9820" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3832",
                "title" : "Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3832" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2024-0553",
                "title" : "Gnutls: incomplete fix for cve-2023-5981",
                "source" : "redhat-csaf",
                "cvssScore" : 7.5,
                "severity" : "HIGH",
                "cves" : [ "CVE-2024-0553" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libuuid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2020-11023",
                "title" : "Potential XSS vulnerability in jQuery",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2020-11023" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libmount@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libblkid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-27456",
                "title" : "util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup",
                "source" : "redhat-csaf",
                "cvssScore" : 4.7,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-27456" ],
                "unique" : false
              }, {
                "id" : "CVE-2026-3184",
                "title" : "Util-linux: util-linux: access control bypass due to improper hostname canonicalization",
                "source" : "redhat-csaf",
                "cvssScore" : 3.7,
                "severity" : "LOW",
                "cves" : [ "CVE-2026-3184" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-14104",
                "title" : "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames",
                "source" : "redhat-csaf",
                "cvssScore" : 6.1,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-14104" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm",
              "issues" : [ {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }, {
                "id" : "CVE-2024-12133",
                "title" : "Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2024-12133" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2025-13151",
                "source" : "redhat-csaf",
                "cvssScore" : 5.9,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2025-13151" ],
                "unique" : false
              }
            }, {
              "ref" : "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm",
              "issues" : [ {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              } ],
              "highestVulnerability" : {
                "id" : "CVE-2026-2100",
                "title" : "P11-kit: null dereference via c_derivekey with specific null parameters",
                "source" : "redhat-csaf",
                "cvssScore" : 5.3,
                "severity" : "MEDIUM",
                "cves" : [ "CVE-2026-2100" ],
                "unique" : false
              }
            } ],
            "highestVulnerability" : {
              "id" : "CVE-2024-2961",
              "source" : "redhat-csaf",
              "cvssScore" : 8.8,
              "severity" : "HIGH",
              "cves" : [ "CVE-2024-2961" ],
              "unique" : false
            }
          } ]
        }
      }
    }
  },
  "licenses" : [ {
    "status" : {
      "ok" : true,
      "name" : "deps.dev",
      "code" : 200,
      "message" : "OK",
      "warnings" : { }
    },
    "summary" : {
      "total" : 0,
      "concluded" : 106,
      "permissive" : 0,
      "weakCopyleft" : 0,
      "strongCopyleft" : 0,
      "unknown" : 0,
      "deprecated" : 0,
      "osiApproved" : 0,
      "fsfLibre" : 0
    },
    "packages" : {
      "pkg:rpm/redhat/json-c@0.14-11.el9?arch=x86_64&distro=rhel-9.2&upstream=json-c-0.14-11.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/systemd-libs@252-14.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=systemd-252-14.el9_2.1.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gobject-introspection@1.68.0-11.el9?arch=x86_64&distro=rhel-9.2&upstream=gobject-introspection-1.68.0-11.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/openldap@2.6.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=openldap-2.6.2-3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/langpacks-core-en@3.0-16.el9?arch=noarch&distro=rhel-9.2&upstream=langpacks-3.0-16.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/pcre@8.44-3.el9.3?arch=x86_64&distro=rhel-9.2&upstream=pcre-8.44-3.el9.3.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gpg-pubkey@fd431d51-4ae0493b?distro=rhel-8.10" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/lz4-libs@1.9.3-5.el9?arch=x86_64&distro=rhel-9.2&upstream=lz4-1.9.3-5.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libyaml@0.2.5-7.el9?arch=x86_64&distro=rhel-9.2&upstream=libyaml-0.2.5-7.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/dejavu-sans-fonts@2.37-18.el9?arch=noarch&distro=rhel-9.2&upstream=dejavu-fonts-2.37-18.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/rpm@4.16.1.3-22.el9?arch=x86_64&distro=rhel-9.2&upstream=rpm-4.16.1.3-22.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glibc-minimal-langpack@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:oci/gh-multi-component-child-ejvc@sha256%3Abe54f204fdf75d5f4e72675789c1cb76831f32be8a31d75df88193e653eb3916" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glibc-common@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/bzip2-libs@1.0.8-8.el9?arch=x86_64&distro=rhel-9.2&upstream=bzip2-1.0.8-8.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libusbx@1.0.26-1.el9?arch=x86_64&distro=rhel-9.2&upstream=libusbx-1.0.26-1.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/grep@3.6-5.el9?arch=x86_64&distro=rhel-9.2&upstream=grep-3.6-5.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/p11-kit-trust@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/krb5-libs@1.20.1-9.el9_2?arch=x86_64&distro=rhel-9.2&upstream=krb5-1.20.1-9.el9_2.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libarchive@3.5.3-4.el9?arch=x86_64&distro=rhel-9.2&upstream=libarchive-3.5.3-4.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/tzdata@2023c-1.el9?arch=noarch&distro=rhel-9.2&upstream=tzdata-2023c-1.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libnghttp2@1.43.0-5.el9?arch=x86_64&distro=rhel-9.2&upstream=nghttp2-1.43.0-5.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gpg-pubkey@5a6340b3-6229229e?distro=rhel-9.2" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libzstd@1.5.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=zstd-1.5.1-2.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/openldap-compat@2.6.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=openldap-2.6.2-3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libverto@0.3.2-3.el9?arch=x86_64&distro=rhel-9.2&upstream=libverto-0.3.2-3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/popt@1.18-8.el9?arch=x86_64&distro=rhel-9.2&upstream=popt-1.18-8.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/ca-certificates@2022.2.54-90.2.el9_0?arch=noarch&distro=rhel-9.2&upstream=ca-certificates-2022.2.54-90.2.el9_0.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsmartcols@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:oci/multi-component-parent-image@sha256%3A87898f08a68d87084dc88ae537a30857f0e940335b3b90242c7c0718592c24eb?repository_url=quay.io%2Fsdouglas%2Fmulti-component-parent-image" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libunistring@0.9.10-15.el9?arch=x86_64&distro=rhel-9.2&upstream=libunistring-0.9.10-15.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/fonts-filesystem@2.0.5-7.el9.1?arch=noarch&distro=rhel-9.2&epoch=1&upstream=fonts-rpm-macros-2.0.5-7.el9.1.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/langpacks-core-font-en@3.0-16.el9?arch=noarch&distro=rhel-9.2&upstream=langpacks-3.0-16.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/sqlite-libs@3.34.1-6.el9_1?arch=x86_64&distro=rhel-9.2&upstream=sqlite-3.34.1-6.el9_1.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gnutls@3.7.6-20.el9_2?arch=x86_64&distro=rhel-9.2&upstream=gnutls-3.7.6-20.el9_2.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcom_err@1.46.5-3.el9?arch=x86_64&distro=rhel-9.2&upstream=e2fsprogs-1.46.5-3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libselinux@3.5-1.el9?arch=x86_64&distro=rhel-9.2&upstream=libselinux-3.5-1.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/crypto-policies@20221215-1.git9a18988.el9?arch=noarch&distro=rhel-9.2&upstream=crypto-policies-20221215-1.git9a18988.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libpeas@1.30.0-4.el9?arch=x86_64&distro=rhel-9.2&upstream=libpeas-1.30.0-4.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/p11-kit@0.24.1-2.el9?arch=x86_64&distro=rhel-9.2&upstream=p11-kit-0.24.1-2.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libmount@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gpgme@1.15.1-6.el9?arch=x86_64&distro=rhel-9.2&upstream=gpgme-1.15.1-6.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libxcrypt@4.4.18-3.el9?arch=x86_64&distro=rhel-9.2&upstream=libxcrypt-4.4.18-3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/lua-libs@5.4.4-3.el9?arch=x86_64&distro=rhel-9.2&upstream=lua-5.4.4-3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/cyrus-sasl-lib@2.1.27-21.el9?arch=x86_64&distro=rhel-9.2&upstream=cyrus-sasl-2.1.27-21.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/microdnf@3.9.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=microdnf-3.9.1-3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/langpacks-en@3.0-16.el9?arch=noarch&distro=rhel-9.2&upstream=langpacks-3.0-16.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libacl@2.3.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=acl-2.3.1-3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/readline@8.1-4.el9?arch=x86_64&distro=rhel-9.2&upstream=readline-8.1-4.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/keyutils-libs@1.6.3-1.el9?arch=x86_64&distro=rhel-9.2&upstream=keyutils-1.6.3-1.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glib2@2.68.4-6.el9?arch=x86_64&distro=rhel-9.2&upstream=glib2-2.68.4-6.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsigsegv@2.13-4.el9?arch=x86_64&distro=rhel-9.2&upstream=libsigsegv-2.13-4.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=rhel-9.2&upstream=xz-5.2.5-8.el9_0.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/zlib@1.2.11-39.el9?arch=x86_64&distro=rhel-9.2&upstream=zlib-1.2.11-39.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=rhel-9.2&upstream=attr-2.5.1-3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/redhat-release@9.2-0.13.el9?arch=x86_64&distro=rhel-9.2&upstream=redhat-release-9.2-0.13.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/rootfiles@8.1-31.el9?arch=noarch&distro=rhel-9.2&upstream=rootfiles-8.1-31.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libffi@3.4.2-7.el9?arch=x86_64&distro=rhel-9.2&upstream=libffi-3.4.2-7.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libdnf@0.69.0-3.el9_2?arch=x86_64&distro=rhel-9.2&upstream=libdnf-0.69.0-3.el9_2.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/setup@2.13.7-9.el9?arch=noarch&distro=rhel-9.2&upstream=setup-2.13.7-9.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libevent@2.1.12-6.el9?arch=x86_64&distro=rhel-9.2&upstream=libevent-2.1.12-6.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/sed@4.8-9.el9?arch=x86_64&distro=rhel-9.2&upstream=sed-4.8-9.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libassuan@2.5.5-3.el9?arch=x86_64&distro=rhel-9.2&upstream=libassuan-2.5.5-3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/alternatives@1.20-2.el9?arch=x86_64&distro=rhel-9.2&upstream=chkconfig-1.20-2.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gnupg2@2.3.3-2.el9_0?arch=x86_64&distro=rhel-9.2&upstream=gnupg2-2.3.3-2.el9_0.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libuuid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/ncurses-base@6.2-8.20210508.el9?arch=noarch&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libstdc%2B%2B@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libgpg-error@1.42-5.el9?arch=x86_64&distro=rhel-9.2&upstream=libgpg-error-1.42-5.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libgcrypt@1.10.0-10.el9_2?arch=x86_64&distro=rhel-9.2&upstream=libgcrypt-1.10.0-10.el9_2.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/curl-minimal@7.76.1-23.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=curl-7.76.1-23.el9_2.1.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/pcre2@10.40-2.el9?arch=x86_64&distro=rhel-9.2&upstream=pcre2-10.40-2.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libmodulemd@2.13.0-2.el9?arch=x86_64&distro=rhel-9.2&upstream=libmodulemd-2.13.0-2.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/filesystem@3.16-2.el9?arch=x86_64&distro=rhel-9.2&upstream=filesystem-3.16-2.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libidn2@2.3.0-7.el9?arch=x86_64&distro=rhel-9.2&upstream=libidn2-2.3.0-7.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/rpm-libs@4.16.1.3-22.el9?arch=x86_64&distro=rhel-9.2&upstream=rpm-4.16.1.3-22.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/bash@5.1.8-6.el9_1?arch=x86_64&distro=rhel-9.2&upstream=bash-5.1.8-6.
100 1029k    0  800k  100  229k  1329k   381k --:--:-- --:--:-- --:--:-- 1707k
el9_1.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/basesystem@11-13.el9?arch=noarch&distro=rhel-9.2&upstream=basesystem-11-13.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=rhel-9.2&upstream=gawk-5.1.0-6.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/json-glib@1.6.6-1.el9?arch=x86_64&distro=rhel-9.2&upstream=json-glib-1.6.6-1.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/coreutils-single@8.32-34.el9?arch=x86_64&distro=rhel-9.2&upstream=coreutils-8.32-34.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/librhsm@0.0.3-7.el9?arch=x86_64&distro=rhel-9.2&upstream=librhsm-0.0.3-7.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/glibc@2.34-60.el9?arch=x86_64&distro=rhel-9.2&upstream=glibc-2.34-60.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/pcre2-syntax@10.40-2.el9?arch=noarch&distro=rhel-9.2&upstream=pcre2-10.40-2.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/npth@1.6-8.el9?arch=x86_64&distro=rhel-9.2&upstream=npth-1.6-8.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/mpfr@4.1.0-7.el9?arch=x86_64&distro=rhel-9.2&upstream=mpfr-4.1.0-7.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libtasn1@4.16.0-8.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libtasn1-4.16.0-8.el9_1.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/librepo@1.14.5-1.el9?arch=x86_64&distro=rhel-9.2&upstream=librepo-1.14.5-1.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsepol@3.5-1.el9?arch=x86_64&distro=rhel-9.2&upstream=libsepol-3.5-1.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libblkid@2.37.4-11.el9_2?arch=x86_64&distro=rhel-9.2&upstream=util-linux-2.37.4-11.el9_2.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libreport-filesystem@2.15.2-6.el9?arch=noarch&distro=rhel-9.2&upstream=libreport-2.15.2-6.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/file-libs@5.39-12.el9?arch=x86_64&distro=rhel-9.2&upstream=file-5.39-12.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcap@2.48-8.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-2.48-8.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/ncurses-libs@6.2-8.20210508.el9?arch=x86_64&distro=rhel-9.2&upstream=ncurses-6.2-8.20210508.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/openssl-libs@3.0.7-16.el9_2?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=openssl-3.0.7-16.el9_2.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gdbm-libs@1.19-4.el9?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=gdbm-1.19-4.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libgcc@11.3.1-4.3.el9?arch=x86_64&distro=rhel-9.2&upstream=gcc-11.3.1-4.3.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libksba@1.5.1-6.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libksba-1.5.1-6.el9_1.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcap-ng@0.8.2-7.el9?arch=x86_64&distro=rhel-9.2&upstream=libcap-ng-0.8.2-7.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libxml2@2.9.13-3.el9_1?arch=x86_64&distro=rhel-9.2&upstream=libxml2-2.9.13-3.el9_1.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/nettle@3.8-3.el9_0?arch=x86_64&distro=rhel-9.2&upstream=nettle-3.8-3.el9_0.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/audit-libs@3.0.7-103.el9?arch=x86_64&distro=rhel-9.2&upstream=audit-3.0.7-103.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libsolv@0.7.22-4.el9?arch=x86_64&distro=rhel-9.2&upstream=libsolv-0.7.22-4.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/dnf-data@4.14.0-5.el9_2?arch=noarch&distro=rhel-9.2&upstream=dnf-4.14.0-5.el9_2.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/gmp@6.2.0-10.el9?arch=x86_64&distro=rhel-9.2&epoch=1&upstream=gmp-6.2.0-10.el9.src.rpm" : {
        "evidence" : [ ]
      },
      "pkg:rpm/redhat/libcurl-minimal@7.76.1-23.el9_2.1?arch=x86_64&distro=rhel-9.2&upstream=curl-7.76.1-23.el9_2.1.src.rpm" : {
        "evidence" : [ ]
      }
    }
  } ]
}