Vulnerability-Lookup

RHSA-2026:74609

Vulnerability from csaf_redhat - Published: 2026-10-01 18:20 - Updated: 2026-10-02 10:08

Summary

Red Hat Security Advisory: Cluster Observability Operator 1.5.3

Severity

Important

Notes

Topic: The Cluster Observability Operator (COO) is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions (CRDs).

Details: The 1.5.3 release of COO.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-19534

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 16 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64	—	Vendor Fix fix Workaround

Known not affected 81 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64	—	Workaround

Threats

Impact Important

CVE-2026-39244

A flaw was found in adm-zip. A remote attacker can exploit this vulnerability by providing a specially crafted ZIP file. The file's header can be manipulated to declare an extremely large uncompressed size, causing the application to allocate an excessive amount of memory. This excessive memory allocation can lead to an immediate process crash, resulting in a Denial of Service (DoS) for any application processing untrusted ZIP files with adm-zip.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Affected products

Fixed 12 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le	—	Vendor Fix fix Workaround

Known not affected 85 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64	—	Workaround

Threats

Impact Moderate

CVE-2026-41178

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64	—	Vendor Fix fix

Known not affected 93 products

Product	Identifier	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64		—

Threats

Impact Important

CVE-2026-42504

A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x	—	Vendor Fix fix Workaround

Known not affected 93 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64	—	Workaround

Threats

Impact Important

CVE-2026-45623

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifically the first few bytes of file content. Additionally, this vulnerability may be exploited to cause a Denial of Service (DoS) by targeting large files, making the system unavailable.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Vendor Fix fix

Known not affected 93 products

Product	Identifier	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64		—

Threats

Impact Moderate

CVE-2026-56864

A flaw was found in golang.org/x/mod/sumdb. A malicious Go checksum database (GOSUMDB) can serve arbitrary module content that is not recorded in the transparency log. This allows a coordinated Go proxy (GOPROXY) and GOSUMDB to deliver malicious module content to a client, which cannot be detected by examining the transparency log. This vulnerability could lead to a supply chain compromise, allowing attackers to distribute malicious code.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-494 - Download of Code Without Integrity Check

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x	—	Vendor Fix fix Workaround

Known not affected 89 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64	—	Workaround

Threats

Impact Important

CVE-2026-56865

A flaw was found in golang.org/x/mod/sumdb/tlog. A malicious Go proxy (GOPROXY) could exploit this vulnerability by forging sumdb tiles. This allowed the proxy to bypass integrity checks and serve malicious module content to a local Go module cache, which would then go undetected by the transparency log. This could lead to a supply chain compromise where users unknowingly incorporate compromised modules.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-347 - Improper Verification of Cryptographic Signature

Affected products

Fixed 8 products, the same list as for CVE-2026-56864

Known not affected 89 products, the same list as for CVE-2026-56864

Threats

Impact Important

CVE-2026-59887

A flaw was found in linkify-it, a library for recognizing links. A remote attacker could exploit this vulnerability by providing specially crafted user text. The mailto: schema validator, when processing this input, can be repeatedly invoked, leading to excessive CPU consumption. This can result in a Denial of Service (DoS) for the affected system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1333 - Inefficient Regular Expression Complexity

Affected products

Fixed 12 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64	—	Vendor Fix fix Workaround

Known not affected 85 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64	—	Workaround

Threats

Impact Important

CVE-2026-63199

A flaw was found in Perses, an open-source dashboard and visualization project. A low-privilege user with datasource creation rights can exploit a missing authorization check in the datasource proxy. This allows the user to attach a project or global secret they cannot otherwise read and cause Perses to send the decrypted secret in plaintext to a service controlled by the attacker. This bypasses project and global scope separation, leading to the disclosure of sensitive information.

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE-1220 - Insufficient Granularity of Access Control

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64	—	Vendor Fix fix Workaround

Known not affected 93 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64	—	Workaround

Threats

Impact Important

CVE-2026-71556

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink, which, when cloned and its worktree operations are used, can lead to reading from or writing to arbitrary files outside the intended working directory. This could result in information disclosure or arbitrary file modification.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64	—	Vendor Fix fix Workaround

Known not affected 89 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64	—	Workaround

Threats

Impact Important

CVE-2026-73086

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-1241 - Use of Predictable Algorithm in Random Number Generator

Affected products

Fixed 4 products, the same list as for CVE-2026-45623

Known not affected 93 products, the same list as for CVE-2026-45623

Threats

Impact Important

CVE-2026-75899

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a loopback address. This vulnerability can lead to Server-Side Request Forgery (SSRF) and bypass host-based security policies.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-140 - Improper Neutralization of Delimiters

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64	—	Vendor Fix fix Workaround

Known not affected 93 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64	—	Workaround

Threats

Impact Important

CVE-2026-75931

A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names (IDN) to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an application might validate a URI against a security policy using one hostname, but then resolve to a different, potentially malicious, hostname. This discrepancy could allow an attacker to bypass security policies and access unauthorized resources.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 4 products, the same list as for CVE-2026-75899

Known not affected 93 products, the same list as for CVE-2026-75899

Threats

Impact Important

CVE-2026-75975

A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a different, valid IPv6 destination, such as a local or private IPv6 target. An application normalizing untrusted URLs before outbound requests, redirects, or proxy routing could be redirected, resulting in a server-side request forgery (SSRF) and address-policy bypass.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-918 - Server-Side Request Forgery (SSRF)

Affected products

Fixed 4 products, the same list as for CVE-2026-75899

Known not affected 93 products, the same list as for CVE-2026-75899

Threats

Impact Important

CVE-2026-76172

A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers (URIs) in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An attacker can exploit this by crafting a malicious URI, causing the parser to misinterpret the host, which can lead to serious security risks. These risks include unauthorized redirection to external websites, server-side request forgery (SSRF) where the application makes unintended requests to internal or external resources, and bypassing security policies.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-76 - Improper Neutralization of Equivalent Special Elements

Affected products

Fixed 4 products, the same list as for CVE-2026-75899

Known not affected 93 products, the same list as for CVE-2026-75899

Threats

Impact Important

CVE-2026-84292

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker's host as legitimate.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-140 - Improper Neutralization of Delimiters

Affected products

Fixed 4 products, the same list as for CVE-2026-75899

Known not affected 93 products, the same list as for CVE-2026-75899

Threats

Impact Important

CVE-2026-84394

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-1289 - Improper Validation of Unsafe Equivalence in Input

Affected products

Fixed 4 products, the same list as for CVE-2026-75899

Known not affected 93 products, the same list as for CVE-2026-75899

Threats

Impact Important

CVE-2026-84445

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Vendor Fix fix
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Vendor Fix fix

Known not affected 89 products

Product	Identifier	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le		—
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64		—

Threats

Impact Important

CVE-2026-84961

A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 16 products, the same list as for CVE-2026-19534

Known not affected 81 products, the same list as for CVE-2026-19534

Threats

Impact Important

CVE-2026-92000

A flaw was found in adm-zip. A remote attacker could exploit this vulnerability by crafting a malicious ZIP archive containing highly compressible entries that declare a zero uncompressed size. This oversight prevents the application of zlib decompression output limits, leading to excessive memory consumption and ultimately a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 28 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64	—	Vendor Fix fix Workaround

Known not affected 69 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64	—	Workaround

Threats

Impact Important

CVE-2026-100690

A flaw was found in Hugo. This vulnerability allows information disclosure when Hugo executes build tools under the Node.js permission model, which validates only lexical file paths and fails to restrict symbolic links pointing outside the sandbox. An attacker capable of contributing content to a repository can exploit this by committing a symbolic link targeting sensitive host files alongside a build tool that reads it. Consequently, files readable by the build process can be exposed and embedded into the published site.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:134bae4b372afbb36cc1c95c549f9c5b913e7937f244420c82dbb24788d0b1c2_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:1ce7459d152ee210ae9f0a5a082f0717367b67eda6ae0f82de432128ee99a336_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:349a98ad8537c8bc08f67ebd30d7b407b654779b233a6eb69d42ba9b195141bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/korrel8r-rhel9@sha256:53f5d6886f01197c1d9e7f979ba5d1b634a25eb3cbf0a579197a1ab64e26f311_arm64	—	Vendor Fix fix Workaround

Known not affected 93 products

Product	Version	Remediation
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:2aa9c685be4d544cf989fa2ca8118f4d3aa7adf4278c0655148b306d07ff6813_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:64e72beecd1e1067521820909c9677641504aad43f33c61ee3d69f8538608fc4_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:aff98d7f2cef39c2278c3781da250ff8bcf30d82f0b65d4cb52a47ea53caeb4f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:2e86c7a5135b2bb135d4bb0c8543f7f5dc4b8badc161ab9de521264f263e6e31_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:786bce056457cb758b2e2d41502f5f3a1a63e6dedb5157b79ad53513d0740895_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:d8f591fe5df9be62f864e3943f07d9c647b8e10a7d83ffe59a3739b1f0ecdcad_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:c51525732a913cb923ae0ff76180d816edb9fa95094ea6b956a5428339bbdffa_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:708c767b670cadcbbfbed9a7ef0397e77b531966b836b3486aeba33ff130f710_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:7f35a826e1b15bc26a39a51f8bf5c4fdcbec439d272ea3598d0a298ad03f1d82_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4c2eaf9749637935dc181ff6d94d605df2d407d2cb0c98b42c423da397a1abb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9339904ffe17f642314001d4bd0c03f37d2386aa18a641bf8795e3774ddecd7a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:abeccc3d710c2188fbf82d25215b14a7f0a4f844a09dcbdc54cdd4836a72b5d9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ac7674bd7e0c29ac03bb48e95f0ce31107501749542992479b2dcfa9e6c3a5ee_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:4f8298d72b446cf43419ea4c44fb11e77559961e8c544c6e5381b5c9494bfe8c_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8e201126c5732fc4b52a7dff62aa6752918365e0d4c17040123a55b5ca361d17_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:a4465e2a727fbcb5b097ff433ad5be533879df2196e94c17c8e5be06a19ee3a4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:c51811c8b2725911126b9fbfa27c84e22bedf8949dbe5ff2fe13516b6cf061d7_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:015934e8094bbdbf93e7efdd2c64b429d2d56646c5a3ce1e11d4c5a6cffd4c07_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:7e75aba089cb03d3e3184a34b372dda8d351ffb14ab073dcca4417b93d96abef_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:630d93f0951c828ccc39e39460e4e2fcc39e7dd1b964f27444b436aaf7ce9e5b_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:eefb6cceecf47f9ebf981be50d3a13e78f7fb63670b211b9c1e39c7b0e6f7e07_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:5d965d20008578a28d099ea0e645a02240231887b4a015e7ccfcc6fd8d76ae1a_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a7160a5a977d5d2f26dbaf4559247ff43056dfce48f68f2ee39349b7ed645d8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:a74e4dabd62c57c99f5136c405d4f1d9290a46ec3a29d8264be3021ff8b97417_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:cbfd934355f48003eadbb126fb6194bf4243235df21af42631c2eb595a06efd6_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:30798c35d49f76441cb38946cb48201cff554b393e5ea8b3de72691f6cd9f7d5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:36a1e9f6c03ed21ebe8d43a84d0a330468c7ab24bcdffc2554e8f6177d57c90e_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:f805e0dc160c0f53e043e3b100ab3ff6104408e011269f7ef48d66854dd9fff4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:0061eeeca2f4408e60bf8e917c2d4986000d3e1699d8b78c8941a6bc233df0d0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:2099462532726936263b92813f03765e72ec14e65eeff9a6e1b0fc87e6d337ce_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:0fbb364e6aa596076105cb58fff463251720e9bc06b7fb65254a7ed2e5796ba9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:8769e3909b568f87b97ee1acf0f9cf9600ac3c14eb35f0717f7d00e453e882cd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:98cacf261897c5b3d7ddd6af01ca224924fef1bc59ffb6545f55f9ef908fd3c5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:813a727ec5ecd081dcb84628d3469330664be30fda80c4086ba6d9c0bfb12a8c_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:92bed5537c071080310bd6f8fabe4296fcde0fc9e6d451143a031728b3038498_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:0784bb3215a532562102de3445f88d964281cf60a58fee60eee8bb8d1487448a_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:2abaf8de5493555f311b14114ed5409ef152bdd6663ce7e4271d111ec6de96d2_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:42e99d9fd0149aa8d2c0712026b51b1286ec7508e5a5d675d1fe3c585ce399cb_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf6-rhel9@sha256:d30621a360a427e24b0bcce578baac6944a6322647406ef5947a9015cd3df46f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:0656b4651b88985ba0cc345fd5b88b0d0b1168e1bf9de57a055591d09522b2ee_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:1c38fce61f0ac9e6143a55b4ea9358006fd8726cf5c5a745de95d5fcefa726a9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:5682858e462879a431fd4bbfec9c788a4989fbd64b8e48a57e876efd06af4b9f_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9@sha256:d3596621e3ce33b574228862376b53e8384a15d0a9c3ca66331cdff8213c81bd_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4d2f78f7618af8d934acb07e3910ff6d60f9edec93f672006fe8065b59eb9639_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:74fefe7be1276261d231980ca6f3e4b2af63fe0bf3f1506a58aee3d60c15eb0b_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:d3f313556a83c3d564818288a30a47a45470fc9a9e8826a5251c69b5f4f872a3_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:e14aeb545aa66f72b196abbfb7a324a54bcb938d0262de2efc1721558bccda20_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:ffece9c75693949bd6c38f7fe70c70730224134aec6d1b7fd9104cb85f091501_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:32f8f5de292c5a0bac46443f21059d6ba0cc6d2d4e0dd6b625bbd85a0bb44cb4_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:45b168b301ad86e5204b6fa072a9108980434889f99597d95850062be1313368_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:bedd67d6eddd46c8608df644502dfc6c91eed236c89ac5b3f0ca2c5cd2c12f69_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel9-operator@sha256:d6cf13d471d0ed40e010df77228703bf6d9ddbd2729e296258e57814c6fe76a5_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:370d2b9fdbba52c672d1e2b1c0101b66ef2aa7693a6138394bdeeca313804e44_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:88e3872a01717bbe1dbd3360d545b5b904ccc6672e99024e3f320d3506451ad5_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:a5facc75873443e7e8b52d36166a042165e4e222080ba5be9970623d43dc0b0f_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9-operator@sha256:fcccbfa4051276255fb708b8dd5c4bd24f79fdd460f7680141b9ecd7830ec0ed_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:0231f871b775f93917e7747d1c2a4256ad00294fdd7f3920639072f327dc4308_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:2401002e26af3dae94cb459d3245abe051ef7d21735ec54b85fc8003eb75c3b2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:9e1986d5e7ee2490a4c7f7f332c80b66f44703fa1bf02032fc32b49391d3a7e4_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/perses-rhel9@sha256:cb052e5b7fd2500b62831dcb324811eb5c6571b1eaad7504ce791d9de1674c81_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:0667f695f49ed3847a626de67cf6078480d9543bc2d09edeb9d7ca8599b34b83_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:4a660731965f5b1ce2873350253c18a9c3c3fea1f1ee84ffe4a890a33a3eb5c9_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8cdf38b93d44e8e26f13b3215da6f56a2836f0a201a76526f705e5d9b9cedc3_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:4f74b8c4e6c00444578ca805dc1e3af816219764c1f8c48345c3990dd7eddd08_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:9181e0d9137862c4c92d85b9a0ad24bd486359ecbc59ed0c64c8dee90e00dc48_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:dc8588e4553e76026557dbcb37ab9adb39626d47a40420f82a2644d2493d034f_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:0a63094088ad7aa3bf38453c413aa0bafad7488c7dc3b1df67904eab2bcc0136_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:8bc7288c52011f98cb5a822e609cc21de7d97d42cf15393efd6de382bae0fbe2_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:c947be7639ee915b92e22ebcfdaf521844f1ebbf60724cc083f9b7ea40e12ed3_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9@sha256:d7eec7f79084cc7724b90747491f100e73152fa8b7665c5191137ac7d9e350d3_arm64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:2f004007a7ff611a69fd1afd04c1ded66c870aab7a951bcf2a06fc5a6545bdd9_s390x	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:6d277aa5239cc4cbd4c8f001dcf8fa9902989a14a53e2312b68a62a03a79ef94_ppc64le	—	Workaround
Unresolved product id: Cluster Observability Operator 1.5.3:registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:d0604c7790b1adacc264ee2de51a54048cd86581402e4f411579b34e515b1784_arm64	—	Workaround

Threats

Impact Moderate

References

171 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:74609	self
https://access.redhat.com/security/cve/CVE-2026-100690	external
https://access.redhat.com/security/cve/CVE-2026-19534	external
https://access.redhat.com/security/cve/CVE-2026-39244	external
https://access.redhat.com/security/cve/CVE-2026-41178	external
https://access.redhat.com/security/cve/CVE-2026-42504	external
https://access.redhat.com/security/cve/CVE-2026-45623	external
https://access.redhat.com/security/cve/CVE-2026-56864	external
https://access.redhat.com/security/cve/CVE-2026-56865	external
https://access.redhat.com/security/cve/CVE-2026-59887	external
https://access.redhat.com/security/cve/CVE-2026-63199	external
https://access.redhat.com/security/cve/CVE-2026-71556	external
https://access.redhat.com/security/cve/CVE-2026-73086	external
https://access.redhat.com/security/cve/CVE-2026-75899	external
https://access.redhat.com/security/cve/CVE-2026-75931	external
https://access.redhat.com/security/cve/CVE-2026-75975	external
https://access.redhat.com/security/cve/CVE-2026-76172	external
https://access.redhat.com/security/cve/CVE-2026-84292	external
https://access.redhat.com/security/cve/CVE-2026-84394	external
https://access.redhat.com/security/cve/CVE-2026-84445	external
https://access.redhat.com/security/cve/CVE-2026-84961	external
https://access.redhat.com/security/cve/CVE-2026-92000	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/updates/classi…	external
https://docs.openshift.com/container-platform/lat…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-19534	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528759	external
https://www.cve.org/CVERecord?id=CVE-2026-19534	external
https://nvd.nist.gov/vuln/detail/CVE-2026-19534	external
https://cna.openjsf.org/security-advisories.html	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-39244	self
https://bugzilla.redhat.com/show_bug.cgi?id=2499083	external
https://www.cve.org/CVERecord?id=CVE-2026-39244	external
https://nvd.nist.gov/vuln/detail/CVE-2026-39244	external
https://github.com/cthackers/adm-zip	external
https://github.com/cthackers/adm-zip/issues/568	external
https://www.npmjs.com/package/adm-zip	external
https://access.redhat.com/security/cve/CVE-2026-41178	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484830	external
https://www.cve.org/CVERecord?id=CVE-2026-41178	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41178	external
https://github.com/open-telemetry/opentelemetry-g…	external
https://github.com/open-telemetry/opentelemetry-g…	external
https://access.redhat.com/security/cve/CVE-2026-42504	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484204	external
https://www.cve.org/CVERecord?id=CVE-2026-42504	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42504	external
https://go.dev/cl/774481	external
https://go.dev/issue/79217	external
https://groups.google.com/g/golang-announce/c/tKs…	external
https://pkg.go.dev/vuln/GO-2026-5038	external
https://access.redhat.com/security/cve/CVE-2026-45623	self
https://bugzilla.redhat.com/show_bug.cgi?id=2507595	external
https://www.cve.org/CVERecord?id=CVE-2026-45623	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45623	external
https://github.com/postcss/postcss/security/advis…	external
https://access.redhat.com/security/cve/CVE-2026-56864	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515836	external
https://www.cve.org/CVERecord?id=CVE-2026-56864	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56864	external
https://go.dev/cl/815000	external
https://go.dev/cl/815020	external
https://go.dev/issue/80745	external
https://groups.google.com/g/golang-announce/c/94p…	external
https://pkg.go.dev/vuln/GO-2026-6180	external
https://access.redhat.com/security/cve/CVE-2026-56865	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515830	external
https://www.cve.org/CVERecord?id=CVE-2026-56865	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56865	external
https://go.dev/cl/814960	external
https://go.dev/issue/80744	external
https://pkg.go.dev/vuln/GO-2026-6179	external
https://access.redhat.com/security/cve/CVE-2026-59887	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498146	external
https://www.cve.org/CVERecord?id=CVE-2026-59887	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59887	external
https://github.com/markdown-it/linkify-it/commit/…	external
https://github.com/markdown-it/linkify-it/release…	external
https://github.com/markdown-it/linkify-it/securit…	external
https://access.redhat.com/security/cve/CVE-2026-63199	self
https://bugzilla.redhat.com/show_bug.cgi?id=2538881	external
https://www.cve.org/CVERecord?id=CVE-2026-63199	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63199	external
https://github.com/perses/perses/commit/2368c9ef4…	external
https://github.com/perses/perses/releases/tag/v0.…	external
https://github.com/perses/perses/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-71556	self
https://bugzilla.redhat.com/show_bug.cgi?id=2512562	external
https://www.cve.org/CVERecord?id=CVE-2026-71556	external
https://nvd.nist.gov/vuln/detail/CVE-2026-71556	external
https://github.com/go-git/go-git/commit/008a78f2d…	external
https://github.com/go-git/go-git/commit/661d1c7f1…	external
https://github.com/go-git/go-git/releases/tag/v5.19.2	external
https://github.com/go-git/go-git/releases/tag/v6.…	external
https://github.com/go-git/go-git/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-73086	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514175	external
https://www.cve.org/CVERecord?id=CVE-2026-73086	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73086	external
https://github.com/ai/nanoid/commit/7087969281cab…	external
https://github.com/ai/nanoid/commit/821dfed7b5db7…	external
https://github.com/ai/nanoid/commit/b0036ed60dc9f…	external
https://github.com/ai/nanoid/releases/tag/3.3.12	external
https://github.com/ai/nanoid/releases/tag/5.1.11	external
https://github.com/ai/nanoid/security/advisories/…	external
https://access.redhat.com/security/cve/CVE-2026-75899	self
https://bugzilla.redhat.com/show_bug.cgi?id=2521778	external
https://www.cve.org/CVERecord?id=CVE-2026-75899	external
https://nvd.nist.gov/vuln/detail/CVE-2026-75899	external
https://github.com/fastify/fast-uri/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-75931	self
https://bugzilla.redhat.com/show_bug.cgi?id=2521777	external
https://www.cve.org/CVERecord?id=CVE-2026-75931	external
https://nvd.nist.gov/vuln/detail/CVE-2026-75931	external
https://github.com/fastify/fast-uri/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-75975	self
https://bugzilla.redhat.com/show_bug.cgi?id=2521779	external
https://www.cve.org/CVERecord?id=CVE-2026-75975	external
https://nvd.nist.gov/vuln/detail/CVE-2026-75975	external
https://github.com/fastify/fast-uri/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-76172	self
https://bugzilla.redhat.com/show_bug.cgi?id=2521798	external
https://www.cve.org/CVERecord?id=CVE-2026-76172	external
https://nvd.nist.gov/vuln/detail/CVE-2026-76172	external
https://github.com/fastify/fast-uri/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-84292	self
https://bugzilla.redhat.com/show_bug.cgi?id=2527747	external
https://www.cve.org/CVERecord?id=CVE-2026-84292	external
https://nvd.nist.gov/vuln/detail/CVE-2026-84292	external
https://github.com/fastify/fast-uri/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-84394	self
https://bugzilla.redhat.com/show_bug.cgi?id=2527756	external
https://www.cve.org/CVERecord?id=CVE-2026-84394	external
https://nvd.nist.gov/vuln/detail/CVE-2026-84394	external
https://github.com/fastify/fast-uri/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-84445	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533175	external
https://www.cve.org/CVERecord?id=CVE-2026-84445	external
https://nvd.nist.gov/vuln/detail/CVE-2026-84445	external
https://github.com/grpc/grpc-go/commit/3822494d8e…	external
https://github.com/grpc/grpc-go/commit/8668b69c16…	external
https://github.com/grpc/grpc-go/commit/93e31b4854…	external
https://github.com/grpc/grpc-go/issues/9354	external
https://github.com/grpc/grpc-go/pull/9365	external
https://github.com/grpc/grpc-go/pull/9366	external
https://github.com/grpc/grpc-go/pull/9367	external
https://github.com/grpc/grpc-go/releases/tag/v1.82.2	external
https://github.com/grpc/grpc-go/releases/tag/v1.83.2	external
https://github.com/grpc/grpc-go/security/advisori…	external
https://access.redhat.com/security/cve/CVE-2026-84961	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528735	external
https://www.cve.org/CVERecord?id=CVE-2026-84961	external
https://nvd.nist.gov/vuln/detail/CVE-2026-84961	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-92000	self
https://bugzilla.redhat.com/show_bug.cgi?id=2534417	external
https://www.cve.org/CVERecord?id=CVE-2026-92000	external
https://nvd.nist.gov/vuln/detail/CVE-2026-92000	external
https://github.com/cthackers/adm-zip/blob/v0.6.0/…	external
https://github.com/cthackers/adm-zip/commit/49160…	external
https://github.com/cthackers/adm-zip/commit/8bc41…	external
https://github.com/cthackers/adm-zip/security/adv…	external
https://www.vulncheck.com/advisories/adm-zip-0.5.…	external
https://access.redhat.com/security/cve/CVE-2026-100690	self
https://bugzilla.redhat.com/show_bug.cgi?id=2541815	external
https://www.cve.org/CVERecord?id=CVE-2026-100690	external
https://nvd.nist.gov/vuln/detail/CVE-2026-100690	external
https://github.com/gohugoio/hugo/security/advisor…	external
https://www.vulncheck.com/advisories/hugo-0.161.0…	external

JSON

To clipboard

Loading 1.9 MB of JSON…

CVE-2026-100690 (GCVE-0-2026-100690)

Vulnerability from cvelistv5 – Published: 2026-09-26 13:23 – Updated: 2026-09-30 15:04

Title

Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Summary

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:04 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/gohugoio/hugo/security/advisor…	vendor-advisory
https://www.vulncheck.com/advisories/hugo-0.161.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gohugoio	hugo	Affected: 0.161.0 , < 0.166.0 (semver) Unaffected: 0.166.0 (semver) cpe:2.3:a:gohugo:hugo::::::::

Date Public

2026-09-09 00:00

Credits

DONG2209

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100690",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:04:21.434495Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:04:40.978Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/gohugoio/hugo",
          "product": "hugo",
          "vendor": "gohugoio",
          "versions": [
            {
              "lessThan": "0.166.0",
              "status": "affected",
              "version": "0.161.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.166.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.166.0",
                  "versionStartIncluding": "0.161.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "DONG2209"
        }
      ],
      "datePublic": "2026-09-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -\u003e /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-26T13:23:49.448Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-x3mx-cm49-8m9c)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-x3mx-cm49-8m9c"
        },
        {
          "name": "VulnCheck Advisory: Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hugo-0.161.0-to-0.165.0-arbitrary-file-read-via-symlinks"
        }
      ],
      "title": "Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-100690",
    "datePublished": "2026-09-26T13:23:49.448Z",
    "dateReserved": "2026-09-26T02:37:41.037Z",
    "dateUpdated": "2026-09-30T15:04:40.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19534 (GCVE-0-2026-19534)

Vulnerability from cvelistv5 – Published: 2026-09-04 17:10 – Updated: 2026-09-04 18:18

Title

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

Summary

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 18:18 UTC

CWE

CWE-248 - Uncaught Exception
CWE-252 - Unchecked Return Value

Assigner

openjs redhat root Scorecard

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 6.7.0 , < 6.28.1 (semver) Unaffected: 6.28.1 (semver) Affected: 7.0.0 , < 7.29.1 (semver) Unaffected: 7.29.1 (semver) Affected: 8.0.0 , < 8.10.2 (semver) Unaffected: 8.10.2 (semver)

Credits

manus-use mcollina UlisesGascon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19534",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T18:18:18.694757Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T18:18:31.205Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.28.1",
              "status": "affected",
              "version": "6.7.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.28.1",
              "versionType": "semver"
            },
            {
              "lessThan": "7.29.1",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.29.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.10.2",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.10.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "manus-use"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "undici\u0027s WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server\u0027s 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node\u0027s default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."
            }
          ],
          "value": "undici\u0027s WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server\u0027s 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node\u0027s default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "CWE-252: Unchecked Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T17:10:05.081Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to Denial of Service via unrequested WebSocket subprotocol",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-19534",
    "datePublished": "2026-09-04T17:10:05.081Z",
    "dateReserved": "2026-08-11T09:36:47.101Z",
    "dateUpdated": "2026-09-04T18:18:31.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-39244 (GCVE-0-2026-39244)

Vulnerability from cvelistv5 – Published: 2026-07-10 00:00 – Updated: 2026-07-10 18:10

Summary

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 18:09 UTC

CWE

n/a
CWE-400 - Uncontrolled Resource Consumption

Assigner

mitre mitre root Scorecard

References

3 references

URL	Tags
https://github.com/cthackers/adm-zip
https://www.npmjs.com/package/adm-zip
https://github.com/cthackers/adm-zip/issues/568

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-39244",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T18:09:41.844175Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T18:10:22.926Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/cthackers/adm-zip/issues/568"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T16:01:40.916Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/cthackers/adm-zip"
        },
        {
          "url": "https://www.npmjs.com/package/adm-zip"
        },
        {
          "url": "https://github.com/cthackers/adm-zip/issues/568"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-39244",
    "datePublished": "2026-07-10T00:00:00.000Z",
    "dateReserved": "2026-04-06T00:00:00.000Z",
    "dateUpdated": "2026-07-10T18:10:22.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41178 (GCVE-0-2026-41178)

Vulnerability from cvelistv5 – Published: 2026-06-04 14:38 – Updated: 2026-06-04 15:46

Title

OpenTelemetry-Go's baggage parsing no longer caps raw header length

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-04 15:46 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
open-telemetry	go.opentelemetry.io/otel/baggage	Affected: = 1.41.0 Affected: = 1.43.0
open-telemetry	go.opentelemetry.io/otel/propagation	Affected: = 1.41.0 Affected: = 1.43.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41178",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T15:46:06.715583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T15:46:11.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go.opentelemetry.io/otel/baggage",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.41.0"
            },
            {
              "status": "affected",
              "version": "= 1.43.0"
            }
          ]
        },
        {
          "product": "go.opentelemetry.io/otel/propagation",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.41.0"
            },
            {
              "status": "affected",
              "version": "= 1.43.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T14:38:23.707Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
        }
      ],
      "source": {
        "advisory": "GHSA-5wrp-cwcj-q835",
        "discovery": "UNKNOWN"
      },
      "title": "OpenTelemetry-Go\u0027s baggage parsing no longer caps raw header length"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41178",
    "datePublished": "2026-06-04T14:38:23.707Z",
    "dateReserved": "2026-04-17T16:34:45.526Z",
    "dateUpdated": "2026-06-04T15:46:11.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42504 (GCVE-0-2026-42504)

Vulnerability from cvelistv5 – Published: 2026-06-02 22:01 – Updated: 2026-10-01 20:48

Title

Quadratic complexity in WordDecoder.DecodeHeader in mime

Summary

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-03 14:05 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

Go Google root Scorecard

References

4 references

URL	Tags
https://go.dev/issue/79217
https://go.dev/cl/774481
https://groups.google.com/g/golang-announce/c/tKs…
https://pkg.go.dev/vuln/GO-2026-5038

Impacted products

1 product

Vendor	Product	Version
Go standard library	mime	Affected: 0 , < 1.25.11 (semver) Affected: 1.26.0-0 , < 1.26.4 (semver)

Credits

p4p3r (https://hackerone.com/p4p3r_hak)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42504",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T14:05:39.682615Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-407",
                "description": "CWE-407 Inefficient Algorithmic Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T14:06:13.623Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "mime",
          "product": "mime",
          "programRoutines": [
            {
              "name": "WordDecoder.DecodeHeader"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.4",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "p4p3r (https://hackerone.com/p4p3r_hak)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T20:48:03.177Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/79217"
        },
        {
          "url": "https://go.dev/cl/774481"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5038"
        }
      ],
      "title": "Quadratic complexity in WordDecoder.DecodeHeader in mime"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-42504",
    "datePublished": "2026-06-02T22:01:37.219Z",
    "dateReserved": "2026-04-28T00:21:12.792Z",
    "dateUpdated": "2026-10-01T20:48:03.177Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45623 (GCVE-0-2026-45623)

Vulnerability from cvelistv5 – Published: 2026-07-27 17:23 – Updated: 2026-07-27 17:44

Title

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

Summary

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 17:44 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root Scorecard

References

1 reference

URL	Tags
https://github.com/postcss/postcss/security/advis…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
postcss	postcss	Affected: < 8.5.12

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45623",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T17:44:10.727948Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T17:44:31.606Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "postcss",
          "vendor": "postcss",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.5.12"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS\u0027s default options \u2014 no from, no map, no plugins required \u2014 and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T17:23:13.326Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"
        }
      ],
      "source": {
        "advisory": "GHSA-6g55-p6wh-862q",
        "discovery": "UNKNOWN"
      },
      "title": "PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45623",
    "datePublished": "2026-07-27T17:23:13.326Z",
    "dateReserved": "2026-05-12T20:31:43.449Z",
    "dateUpdated": "2026-07-27T17:44:31.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56864 (GCVE-0-2026-56864)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:16

Title

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

Summary

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 16:16 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

Go Google root Scorecard

References

5 references

URL	Tags
https://go.dev/issue/80745
https://groups.google.com/g/golang-announce/c/94p…
https://go.dev/cl/815000
https://go.dev/cl/815020
https://pkg.go.dev/vuln/GO-2026-6180

Impacted products

2 products

Vendor	Product	Version
Go toolchain	cmd/go	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)
golang.org/x/mod	golang.org/x/mod/sumdb	Affected: 0 , < 0.40.0 (semver)

Credits

mundur

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56864",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T16:16:37.911009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-347",
                "description": "CWE-347 Improper Verification of Cryptographic Signature",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T16:16:42.248Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/go",
          "product": "cmd/go",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/mod/sumdb",
          "product": "golang.org/x/mod/sumdb",
          "programRoutines": [
            {
              "name": "Client.Lookup"
            }
          ],
          "vendor": "golang.org/x/mod",
          "versions": [
            {
              "lessThan": "0.40.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "mundur"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.605Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80745"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://go.dev/cl/815000"
        },
        {
          "url": "https://go.dev/cl/815020"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6180"
        }
      ],
      "title": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56864",
    "datePublished": "2026-08-13T21:58:53.605Z",
    "dateReserved": "2026-06-23T15:10:49.354Z",
    "dateUpdated": "2026-08-14T16:16:42.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56865 (GCVE-0-2026-56865)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:34

Title

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

Summary

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:33 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

Go Google root Scorecard

References

5 references

URL	Tags
https://go.dev/issue/80744
https://groups.google.com/g/golang-announce/c/94p…
https://go.dev/cl/814960
https://go.dev/cl/815020
https://pkg.go.dev/vuln/GO-2026-6179

Impacted products

2 products

Vendor	Product	Version
Go toolchain	cmd/go	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)
golang.org/x/mod	golang.org/x/mod/sumdb/tlog	Affected: 0 , < 0.40.0 (semver)

Credits

Filippo Valsorda (Geomys)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56865",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:33:28.143873Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-347",
                "description": "CWE-347 Improper Verification of Cryptographic Signature",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:34:17.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/go",
          "product": "cmd/go",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/mod/sumdb/tlog",
          "product": "golang.org/x/mod/sumdb/tlog",
          "programRoutines": [
            {
              "name": "tileHashReader.ReadHashes"
            }
          ],
          "vendor": "golang.org/x/mod",
          "versions": [
            {
              "lessThan": "0.40.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Filippo Valsorda (Geomys)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.475Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80744"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://go.dev/cl/814960"
        },
        {
          "url": "https://go.dev/cl/815020"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6179"
        }
      ],
      "title": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56865",
    "datePublished": "2026-08-13T21:58:53.475Z",
    "dateReserved": "2026-06-23T15:10:49.354Z",
    "dateUpdated": "2026-08-14T15:34:17.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59887 (GCVE-0-2026-59887)

Vulnerability from cvelistv5 – Published: 2026-07-08 15:58 – Updated: 2026-07-09 14:41

Title

linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

Summary

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 14:40 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/markdown-it/linkify-it/securit…	x_refsource_CONFIRM
https://github.com/markdown-it/linkify-it/commit/…	x_refsource_MISC
https://github.com/markdown-it/linkify-it/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
markdown-it	linkify-it	Affected: < 5.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59887",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:40:56.927532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T14:41:02.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "linkify-it",
          "vendor": "markdown-it",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T15:58:12.114Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm"
        },
        {
          "name": "https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe"
        },
        {
          "name": "https://github.com/markdown-it/linkify-it/releases/tag/5.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/markdown-it/linkify-it/releases/tag/5.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-v245-v573-v5vm",
        "discovery": "UNKNOWN"
      },
      "title": "linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59887",
    "datePublished": "2026-07-08T15:58:12.114Z",
    "dateReserved": "2026-07-07T16:40:07.983Z",
    "dateUpdated": "2026-07-09T14:41:02.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63199 (GCVE-0-2026-63199)

Vulnerability from cvelistv5 – Published: 2026-09-18 17:36 – Updated: 2026-09-24 21:05

Title

Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure

Summary

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately grantable associated project or global Secret before resolving it. A low-privilege user with GlobalDatasource:create or corresponding project datasource creation rights can attach a project or global Secret that the user cannot otherwise read, point the datasource at a service controlled by the user, and cause Perses to send the decrypted secret in plaintext, bypassing project and global scope separation. This issue is fixed in version 0.54.0-rc.0.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 21:01 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/perses/perses/security/advisor…	x_refsource_CONFIRM
https://github.com/perses/perses/commit/2368c9ef4…	x_refsource_MISC
https://github.com/perses/perses/releases/tag/v0.…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
perses	perses	Affected: >= 0.43.0, < 0.54.0-rc.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63199",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T21:01:42.526103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T21:05:26.515Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "perses",
          "vendor": "perses",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.43.0, \u003c 0.54.0-rc.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately grantable associated project or global Secret before resolving it. A low-privilege user with GlobalDatasource:create or corresponding project datasource creation rights can attach a project or global Secret that the user cannot otherwise read, point the datasource at a service controlled by the user, and cause Perses to send the decrypted secret in plaintext, bypassing project and global scope separation. This issue is fixed in version 0.54.0-rc.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:36:05.256Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx"
        },
        {
          "name": "https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625"
        },
        {
          "name": "https://github.com/perses/perses/releases/tag/v0.54.0-rc.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/perses/perses/releases/tag/v0.54.0-rc.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4227-9989-jrhx",
        "discovery": "UNKNOWN"
      },
      "title": "Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63199",
    "datePublished": "2026-09-18T17:36:05.256Z",
    "dateReserved": "2026-07-15T22:13:00.722Z",
    "dateUpdated": "2026-09-24T21:05:26.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:74609

CVE-2026-100690 (GCVE-0-2026-100690)

CVE-2026-19534 (GCVE-0-2026-19534)

CVE-2026-39244 (GCVE-0-2026-39244)

CVE-2026-41178 (GCVE-0-2026-41178)

CVE-2026-42504 (GCVE-0-2026-42504)

CVE-2026-45623 (GCVE-0-2026-45623)

CVE-2026-56864 (GCVE-0-2026-56864)

CVE-2026-56865 (GCVE-0-2026-56865)

CVE-2026-59887 (GCVE-0-2026-59887)

CVE-2026-63199 (GCVE-0-2026-63199)

Tags

Sightings

Nomenclature

Related by attack behaviour