{
  "threat_severity" : "Important",
  "public_date" : "2026-05-04T18:13:12Z",
  "bugzilla" : {
    "description" : "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
    "id" : "2466505",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-770",
  "details" : [ "Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.", "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process." ],
  "statement" : "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:34357",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "opentelemetry-collector-0:0.152.1-1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:34359",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "opentelemetry-collector-0:0.152.1-1.el9_8"
  }, {
    "product_name" : "RHEM 1.0 for RHEL 9",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36796",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "flightctl-0:1.0.3-1.el9em"
  }, {
    "product_name" : "RHEM 1.1 for RHEL 10",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41019",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "flightctl-0:1.1.3-1.el10em"
  }, {
    "product_name" : "RHEM 1.1 for RHEL 9",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41019",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1:el9",
    "package" : "flightctl-0:1.1.3-1.el9em"
  }, {
    "product_name" : "Logging Subsystem for Red Hat OpenShift 6.4",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:34364",
    "cpe" : "cpe:/a:redhat:logging:6.4::el9",
    "package" : "openshift-logging/logging-loki-rhel9:1782405469"
  }, {
    "product_name" : "Multicluster Global Hub 1.4.5",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41030",
    "cpe" : "cpe:/a:redhat:multicluster_globalhub:1.4::el9",
    "package" : "multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1784060681"
  }, {
    "product_name" : "Multicluster Global Hub 1.5.6",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:42852",
    "cpe" : "cpe:/a:redhat:multicluster_globalhub:1.5::el9",
    "package" : "multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1784562060"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.13",
    "release_date" : "2026-06-28T00:00:00Z",
    "advisory" : "RHSA-2026:30651",
    "cpe" : "cpe:/a:redhat:acm:2.13::el9",
    "package" : "rhacm2/prometheus-rhel9:1782374537"
  }, {
    "product_name" : "Red Hat Edge Manager 1.0",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36651",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "rhem/flightctl-alert-exporter-rhel9:1783502022"
  }, {
    "product_name" : "Red Hat Edge Manager 1.0",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36651",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "rhem/flightctl-alertmanager-proxy-rhel9:1783502465"
  }, {
    "product_name" : "Red Hat Edge Manager 1.0",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36651",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "rhem/flightctl-api-rhel9:1783502025"
  }, {
    "product_name" : "Red Hat Edge Manager 1.0",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36651",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "rhem/flightctl-cli-artifacts-rhel9:1783502494"
  }, {
    "product_name" : "Red Hat Edge Manager 1.0",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36651",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "rhem/flightctl-db-setup-rhel9:1783502401"
  }, {
    "product_name" : "Red Hat Edge Manager 1.0",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36651",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "rhem/flightctl-pam-issuer-rhel9:1783502403"
  }, {
    "product_name" : "Red Hat Edge Manager 1.0",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36651",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "rhem/flightctl-periodic-rhel9:1783502022"
  }, {
    "product_name" : "Red Hat Edge Manager 1.0",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36651",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "rhem/flightctl-telemetry-gateway-rhel9:1783502023"
  }, {
    "product_name" : "Red Hat Edge Manager 1.0",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36651",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "rhem/flightctl-userinfo-proxy-rhel9:1783502029"
  }, {
    "product_name" : "Red Hat Edge Manager 1.0",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36651",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "rhem/flightctl-worker-rhel9:1783502445"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-alert-exporter-rhel10:1784194638"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-alertmanager-proxy-rhel10:1784194353"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-api-rhel10:1784196588"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-cli-artifacts-rhel10:1784195620"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-db-setup-rhel10:1784194309"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-imagebuilder-api-rhel10:1784194144"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-imagebuilder-worker-rhel10:1784194188"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-pam-issuer-rhel10:1784194653"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-periodic-rhel10:1784194144"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-telemetry-gateway-rhel10:1784194980"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-userinfo-proxy-rhel10:1784194347"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-worker-rhel10:1784194971"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-alert-exporter-rhel9:1784128388"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-alertmanager-proxy-rhel9:1784128860"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-api-rhel9:1784126780"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-cli-artifacts-rhel9:1784127787"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-db-setup-rhel9:1784126762"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-imagebuilder-api-rhel9:1784127762"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-imagebuilder-worker-rhel9:1784126832"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-pam-issuer-rhel9:1784126774"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-periodic-rhel9:1784127791"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-telemetry-gateway-rhel9:1784127135"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-userinfo-proxy-rhel9:1784126733"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-worker-rhel9:1784127775"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25039",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "jaeger-main-2.19.0-1.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-11T00:00:00Z",
    "advisory" : "RHSA-2026:25245",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "opentelemetry-collector-main-0.153.0-1.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-25T00:00:00Z",
    "advisory" : "RHSA-2026:29770",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "opentelemetry-collector-contrib-main-0.155.0-0.1.hum1"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.21",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:40792",
    "cpe" : "cpe:/a:redhat:openshift:4.21::el9",
    "package" : "openshift4/ose-prometheus-rhel9:1784053555"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.22",
    "release_date" : "2026-07-07T00:00:00Z",
    "advisory" : "RHSA-2026:34794",
    "cpe" : "cpe:/a:redhat:openshift:4.22::el9",
    "package" : "openshift4/ose-prometheus-rhel9:1782859326"
  }, {
    "product_name" : "Red Hat Quay 3.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41031",
    "cpe" : "cpe:/a:redhat:quay:3.10::el8",
    "package" : "quay/quay-rhel8:1783750447"
  }, {
    "product_name" : "Red Hat Quay 3.12",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:42146",
    "cpe" : "cpe:/a:redhat:quay:3.12::el8",
    "package" : "quay/quay-rhel8:1783751865"
  }, {
    "product_name" : "Red Hat Quay 3.15",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:42796",
    "cpe" : "cpe:/a:redhat:quay:3.15::el8",
    "package" : "quay/quay-rhel8:1784351966"
  }, {
    "product_name" : "Red Hat Quay 3.16",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41066",
    "cpe" : "cpe:/a:redhat:quay:3.16::el9",
    "package" : "quay/quay-rhel9:1783955846"
  }, {
    "product_name" : "Red Hat Quay 3.9",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40262",
    "cpe" : "cpe:/a:redhat:quay:3.9::el8",
    "package" : "quay/quay-rhel8:1784125838"
  }, {
    "product_name" : "Red Hat Trusted Artifact Signer 1.3",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40970",
    "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.3::el9",
    "package" : "rhtas/createtree-rhel9:1783968861"
  }, {
    "product_name" : "Red Hat Trusted Artifact Signer 1.3",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40972",
    "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.3::el9",
    "package" : "rhtas/updatetree-rhel9:1783968861"
  }, {
    "product_name" : "Red Hat Trusted Artifact Signer 1.3",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40974",
    "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.3::el9",
    "package" : "rhtas/certificate-transparency-rhel9:1783968468"
  }, {
    "product_name" : "Red Hat Trusted Artifact Signer 1.3",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40974",
    "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.3::el9",
    "package" : "rhtas/trillian-database-rhel9:1783960127"
  }, {
    "product_name" : "Red Hat Trusted Artifact Signer 1.3",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40974",
    "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.3::el9",
    "package" : "rhtas/trillian-logserver-rhel9:1783968861"
  }, {
    "product_name" : "Red Hat Trusted Artifact Signer 1.3",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40974",
    "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.3::el9",
    "package" : "rhtas/trillian-logsigner-rhel9:1783968861"
  } ],
  "package_state" : [ {
    "product_name" : "File Integrity Operator",
    "fix_state" : "Affected",
    "package_name" : "compliance/openshift-compliance-must-gather-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_file_integrity_operator:1"
  }, {
    "product_name" : "File Integrity Operator",
    "fix_state" : "Affected",
    "package_name" : "compliance/openshift-compliance-openscap-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_file_integrity_operator:1"
  }, {
    "product_name" : "File Integrity Operator",
    "fix_state" : "Affected",
    "package_name" : "compliance/openshift-compliance-operator-bundle",
    "cpe" : "cpe:/a:redhat:openshift_file_integrity_operator:1"
  }, {
    "product_name" : "File Integrity Operator",
    "fix_state" : "Affected",
    "package_name" : "compliance/openshift-compliance-rhel8-operator",
    "cpe" : "cpe:/a:redhat:openshift_file_integrity_operator:1"
  }, {
    "product_name" : "File Integrity Operator",
    "fix_state" : "Affected",
    "package_name" : "compliance/openshift-file-integrity-operator-bundle",
    "cpe" : "cpe:/a:redhat:openshift_file_integrity_operator:1"
  }, {
    "product_name" : "File Integrity Operator",
    "fix_state" : "Affected",
    "package_name" : "compliance/openshift-file-integrity-rhel8-operator",
    "cpe" : "cpe:/a:redhat:openshift_file_integrity_operator:1"
  }, {
    "product_name" : "Logging Subsystem for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-logging/loki-rhel9-operator",
    "cpe" : "cpe:/a:redhat:logging:6"
  }, {
    "product_name" : "Logging Subsystem for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-logging/lokistack-gateway-rhel9",
    "cpe" : "cpe:/a:redhat:logging:6"
  }, {
    "product_name" : "Logging Subsystem for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-logging/opa-openshift-rhel9",
    "cpe" : "cpe:/a:redhat:logging:6"
  }, {
    "product_name" : "Network Observability Operator",
    "fix_state" : "Affected",
    "package_name" : "network-observability/network-observability-ebpf-agent-rhel9",
    "cpe" : "cpe:/a:redhat:network_observ_optr:1"
  }, {
    "product_name" : "Network Observability Operator",
    "fix_state" : "Affected",
    "package_name" : "network-observability/network-observability-flowlogs-pipeline-rhel9",
    "cpe" : "cpe:/a:redhat:network_observ_optr:1"
  }, {
    "product_name" : "OpenShift Lightspeed",
    "fix_state" : "Affected",
    "package_name" : "openshift-lightspeed/openshift-mcp-server-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_lightspeed"
  }, {
    "product_name" : "OpenShift Service Mesh 2",
    "fix_state" : "Not affected",
    "package_name" : "openshift-service-mesh/istio-cni-rhel8",
    "cpe" : "cpe:/a:redhat:service_mesh:2"
  }, {
    "product_name" : "OpenShift Service Mesh 2",
    "fix_state" : "Not affected",
    "package_name" : "openshift-service-mesh/istio-rhel8-operator",
    "cpe" : "cpe:/a:redhat:service_mesh:2"
  }, {
    "product_name" : "OpenShift Service Mesh 2",
    "fix_state" : "Not affected",
    "package_name" : "openshift-service-mesh/pilot-rhel8",
    "cpe" : "cpe:/a:redhat:service_mesh:2"
  }, {
    "product_name" : "OpenShift Service Mesh 2",
    "fix_state" : "Not affected",
    "package_name" : "openshift-service-mesh/proxyv2-rhel9",
    "cpe" : "cpe:/a:redhat:service_mesh:2"
  }, {
    "product_name" : "OpenShift Service Mesh 3",
    "fix_state" : "Not affected",
    "package_name" : "openshift-service-mesh/istio-cni-rhel9",
    "cpe" : "cpe:/a:redhat:service_mesh:3"
  }, {
    "product_name" : "OpenShift Service Mesh 3",
    "fix_state" : "Not affected",
    "package_name" : "openshift-service-mesh/istio-pilot-rhel9",
    "cpe" : "cpe:/a:redhat:service_mesh:3"
  }, {
    "product_name" : "OpenShift Service Mesh 3",
    "fix_state" : "Not affected",
    "package_name" : "openshift-service-mesh/istio-proxyv2-rhel9",
    "cpe" : "cpe:/a:redhat:service_mesh:3"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/acm-grafana-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/acm-multicluster-observability-addon-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/acm-prometheus-config-reloader-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/acm-prometheus-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/endpoint-monitoring-rhel9-operator",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/grafana-dashboard-loader-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/metrics-collector-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/multicluster-observability-rhel9-operator",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/obo-prometheus-rhel9-operator",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/observatorium-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/rbac-query-proxy-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/thanos-receive-controller-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/thanos-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Ceph Storage 5",
    "fix_state" : "Affected",
    "package_name" : "rhceph/rhceph-5-dashboard-rhel8",
    "cpe" : "cpe:/a:redhat:ceph_storage:5"
  }, {
    "product_name" : "Red Hat Ceph Storage 6",
    "fix_state" : "Affected",
    "package_name" : "rhceph/rhceph-6-dashboard-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:6"
  }, {
    "product_name" : "Red Hat Ceph Storage 6",
    "fix_state" : "Affected",
    "package_name" : "rhceph/rhceph-promtail-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:6"
  }, {
    "product_name" : "Red Hat Ceph Storage 7",
    "fix_state" : "Affected",
    "package_name" : "rhceph/grafana-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:7"
  }, {
    "product_name" : "Red Hat Ceph Storage 7",
    "fix_state" : "Affected",
    "package_name" : "rhceph/rhceph-promtail-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:7"
  }, {
    "product_name" : "Red Hat Ceph Storage 8",
    "fix_state" : "Affected",
    "package_name" : "rhceph/grafana-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:8"
  }, {
    "product_name" : "Red Hat Ceph Storage 8",
    "fix_state" : "Affected",
    "package_name" : "rhceph/rhceph-promtail-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:8"
  }, {
    "product_name" : "Red Hat Ceph Storage 9",
    "fix_state" : "Affected",
    "package_name" : "rhceph/grafana-rhel10",
    "cpe" : "cpe:/a:redhat:ceph_storage:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "grafana",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "host-metering",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "grafana",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "grafana",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "rust",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Not affected",
    "package_name" : "rhoai/odh-kserve-agent-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Not affected",
    "package_name" : "rhoai/odh-kserve-controller-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Not affected",
    "package_name" : "rhoai/odh-kserve-router-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-llm-d-inference-scheduler-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-llm-d-routing-sidecar-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Not affected",
    "package_name" : "rhoai/odh-model-registry-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "microshift",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/cnf-tests-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/kube-metrics-server-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/kube-metrics-server-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/microshift-bootc-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-cluster-monitoring-operator",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-cluster-monitoring-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-prometheus",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-prometheus-config-reloader",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-prometheus-config-reloader-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-prometheus-operator",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-prometheus-operator-admission-webhook-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-prometheus-operator-admission-webhook-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-prometheus-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-prom-label-proxy",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-prom-label-proxy-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-telemeter",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-telemeter-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-thanos-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-thanos-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ztp-site-generate-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Will not fix",
    "package_name" : "openshift-gitops-1/argocd-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/argocd-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenStack Platform 18.0",
    "fix_state" : "Not affected",
    "package_name" : "rhoso-operators/openstack-operator-bundle",
    "cpe" : "cpe:/a:redhat:openstack:18.0"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-42154\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42154\nhttps://github.com/prometheus/prometheus/pull/18584\nhttps://github.com/prometheus/prometheus/pull/18585\nhttps://github.com/prometheus/prometheus/releases/tag/v3.11.3\nhttps://github.com/prometheus/prometheus/releases/tag/v3.5.3\nhttps://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm" ],
  "name" : "CVE-2026-42154",
  "csaw" : false
}