{
  "document" : {
    "aggregate_severity" : {
      "namespace" : "https://access.redhat.com/security/updates/classification/",
      "text" : "Important"
    },
    "category" : "csaf_security_advisory",
    "csaf_version" : "2.0",
    "distribution" : {
      "text" : "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "en",
    "notes" : [ {
      "category" : "summary",
      "text" : "Red Hat Web Terminal Operator 1.16.3 has been released.",
      "title" : "Topic"
    }, {
      "category" : "general",
      "text" : "The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.",
      "title" : "Details"
    }, {
      "category" : "legal_disclaimer",
      "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
      "title" : "Terms of Use"
    } ],
    "publisher" : {
      "category" : "vendor",
      "contact_details" : "https://access.redhat.com/security/team/contact/",
      "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name" : "Red Hat Product Security",
      "namespace" : "https://www.redhat.com"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "https://access.redhat.com/errata/RHSA-2026:94071",
      "url" : "https://access.redhat.com/errata/RHSA-2026:94071"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/cve/CVE-2026-44740",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-44740"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/cve/CVE-2026-56852",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-56852"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/cve/CVE-2026-71556",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-71556"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/updates/classification/",
      "url" : "https://access.redhat.com/security/updates/classification/"
    }, {
      "category" : "external",
      "summary" : "https://redhat.atlassian.net/browse/WTO-511",
      "url" : "https://redhat.atlassian.net/browse/WTO-511"
    }, {
      "category" : "external",
      "summary" : "https://redhat.atlassian.net/browse/WTO-557",
      "url" : "https://redhat.atlassian.net/browse/WTO-557"
    }, {
      "category" : "external",
      "summary" : "https://redhat.atlassian.net/browse/WTO-586",
      "url" : "https://redhat.atlassian.net/browse/WTO-586"
    }, {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94071.json"
    } ],
    "title" : "Red Hat Security Advisory: Red Hat Web Terminal Operator 1.16.3 release.",
    "tracking" : {
      "current_release_date" : "2026-11-08T10:56:47+00:00",
      "generator" : {
        "date" : "2026-11-08T10:56:47+00:00",
        "engine" : {
          "name" : "Red Hat SDEngine",
          "version" : "5.4.5"
        }
      },
      "id" : "RHSA-2026:94071",
      "initial_release_date" : "2026-11-02T20:43:58+00:00",
      "revision_history" : [ {
        "date" : "2026-11-02T20:43:58+00:00",
        "number" : "1",
        "summary" : "Initial version"
      }, {
        "date" : "2026-11-02T20:44:06+00:00",
        "number" : "2",
        "summary" : "Last updated version"
      }, {
        "date" : "2026-11-08T10:56:47+00:00",
        "number" : "3",
        "summary" : "Last generated version"
      } ],
      "status" : "final",
      "version" : "3"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Red Hat Web Terminal 1.16",
          "product" : {
            "name" : "Red Hat Web Terminal 1.16",
            "product_id" : "Red Hat Web Terminal 1.16",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:redhat:webterminal:1.16::el9"
            }
          }
        } ],
        "category" : "product_family",
        "name" : "Red Hat Web Terminal"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64",
          "product" : {
            "name" : "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64",
            "product_id" : "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/web-terminal-exec-rhel9@sha256%3Ae6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e?arch=amd64&repository_url=registry.redhat.io/web-terminal/web-terminal-exec-rhel9&tag=1793129530"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64",
          "product" : {
            "name" : "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64",
            "product_id" : "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/web-terminal-rhel9-operator@sha256%3A5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569?arch=amd64&repository_url=registry.redhat.io/web-terminal/web-terminal-rhel9-operator&tag=1793129538"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64",
          "product" : {
            "name" : "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64",
            "product_id" : "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/web-terminal-operator-bundle@sha256%3A2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa?arch=amd64&repository_url=registry.redhat.io/web-terminal/web-terminal-operator-bundle&tag=1793204561"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64",
          "product" : {
            "name" : "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64",
            "product_id" : "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/web-terminal-tooling-rhel9@sha256%3A82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95?arch=amd64&repository_url=registry.redhat.io/web-terminal/web-terminal-tooling-rhel9&tag=1793129553"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "amd64"
      } ],
      "category" : "vendor",
      "name" : "Red Hat"
    } ],
    "relationships" : [ {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64 as a component of Red Hat Web Terminal 1.16",
        "product_id" : "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64"
      },
      "product_reference" : "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64",
      "relates_to_product_reference" : "Red Hat Web Terminal 1.16"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64 as a component of Red Hat Web Terminal 1.16",
        "product_id" : "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64"
      },
      "product_reference" : "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64",
      "relates_to_product_reference" : "Red Hat Web Terminal 1.16"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64 as a component of Red Hat Web Terminal 1.16",
        "product_id" : "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64"
      },
      "product_reference" : "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64",
      "relates_to_product_reference" : "Red Hat Web Terminal 1.16"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64 as a component of Red Hat Web Terminal 1.16",
        "product_id" : "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64"
      },
      "product_reference" : "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64",
      "relates_to_product_reference" : "Red Hat Web Terminal 1.16"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2026-44740",
    "cwe" : {
      "id" : "CWE-606",
      "name" : "Unchecked Input for Loop Condition"
    },
    "discovery_date" : "2026-06-01T17:01:53.685793+00:00",
    "flags" : [ {
      "label" : "vulnerable_code_not_present",
      "product_ids" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64" ]
    } ],
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2483894"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "This is rated as an Important severity issue. The `go-billy` library, a Go filesystem abstraction, is vulnerable to a denial of service when processing crafted or malformed input, such as untrusted repository data or filesystem structures. Insufficient validation and missing safety mechanisms can lead to panics, infinite loops, or excessive resource consumption, potentially impacting the availability of applications that rely on this library.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ],
      "known_not_affected" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-44740"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2483894",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2483894"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-44740",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-44740"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-44740",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-44740"
    }, {
      "category" : "external",
      "summary" : "https://github.com/go-git/go-billy/releases/tag/v5.9.0",
      "url" : "https://github.com/go-git/go-billy/releases/tag/v5.9.0"
    }, {
      "category" : "external",
      "summary" : "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1",
      "url" : "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1"
    }, {
      "category" : "external",
      "summary" : "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6",
      "url" : "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"
    } ],
    "release_date" : "2026-06-01T16:04:50.358000+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-11-02T20:43:58+00:00",
      "details" : "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.21 or higher.",
      "product_ids" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:94071"
    }, {
      "category" : "workaround",
      "details" : "To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+",
      "product_ids" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ]
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "LOW",
        "attackVector" : "NETWORK",
        "availabilityImpact" : "HIGH",
        "baseScore" : 7.5,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "NONE",
        "integrityImpact" : "NONE",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "NONE",
        "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "version" : "3.1"
      },
      "products" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation"
  }, {
    "cve" : "CVE-2026-56852",
    "cwe" : {
      "id" : "CWE-835",
      "name" : "Loop with Unreachable Exit Condition"
    },
    "discovery_date" : "2026-07-21T20:01:56.266823+00:00",
    "flags" : [ {
      "label" : "vulnerable_code_not_present",
      "product_ids" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ]
    } ],
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2504233"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64" ],
      "known_not_affected" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-56852"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2504233",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-56852",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-56852"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
    }, {
      "category" : "external",
      "summary" : "https://go.dev/cl/794100",
      "url" : "https://go.dev/cl/794100"
    }, {
      "category" : "external",
      "summary" : "https://go.dev/issue/80142",
      "url" : "https://go.dev/issue/80142"
    }, {
      "category" : "external",
      "summary" : "https://pkg.go.dev/vuln/GO-2026-5970",
      "url" : "https://pkg.go.dev/vuln/GO-2026-5970"
    } ],
    "release_date" : "2026-07-21T19:18:59.951000+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-11-02T20:43:58+00:00",
      "details" : "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.21 or higher.",
      "product_ids" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:94071"
    }, {
      "category" : "workaround",
      "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
      "product_ids" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ]
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "LOW",
        "attackVector" : "NETWORK",
        "availabilityImpact" : "HIGH",
        "baseScore" : 7.5,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "NONE",
        "integrityImpact" : "NONE",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "NONE",
        "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "version" : "3.1"
      },
      "products" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
  }, {
    "cve" : "CVE-2026-71556",
    "cwe" : {
      "id" : "CWE-59",
      "name" : "Improper Link Resolution Before File Access"
    },
    "discovery_date" : "2026-08-07T16:51:14.251077+00:00",
    "flags" : [ {
      "label" : "vulnerable_code_not_present",
      "product_ids" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64" ]
    } ],
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2512562"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink, which, when cloned and its worktree operations are used, can lead to reading from or writing to arbitrary files outside the intended working directory. This could result in information disclosure or arbitrary file modification.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "go-git is a pure-Go implementation of Git. During worktree operations (checkout, status, add), go-git resolves symbolic links without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause a consuming application to read from or write to files outside the intended working directory when that repository is cloned and its worktree operations are used. Exploitation requires the application to clone an attacker-controlled repository and then perform worktree operations against it; applications that only process trusted repositories are not exposed. Red Hat rates the impact of this flaw as Important.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ],
      "known_not_affected" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-71556"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2512562",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2512562"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-71556",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-71556"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-71556",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-71556"
    }, {
      "category" : "external",
      "summary" : "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab",
      "url" : "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"
    }, {
      "category" : "external",
      "summary" : "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac",
      "url" : "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"
    }, {
      "category" : "external",
      "summary" : "https://github.com/go-git/go-git/releases/tag/v5.19.2",
      "url" : "https://github.com/go-git/go-git/releases/tag/v5.19.2"
    }, {
      "category" : "external",
      "summary" : "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5",
      "url" : "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"
    }, {
      "category" : "external",
      "summary" : "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm",
      "url" : "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"
    } ],
    "release_date" : "2026-08-07T16:37:40.058000+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-11-02T20:43:58+00:00",
      "details" : "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.21 or higher.",
      "product_ids" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:94071"
    }, {
      "category" : "workaround",
      "details" : "To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).",
      "product_ids" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ]
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "LOW",
        "attackVector" : "NETWORK",
        "availabilityImpact" : "LOW",
        "baseScore" : 7.1,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "NONE",
        "integrityImpact" : "HIGH",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "REQUIRED",
        "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
        "version" : "3.1"
      },
      "products" : [ "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:e6fa38c197ad3b148b56e8a686e7fb6d062f0a3e15cc6a4d50f593c628acd60e_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2410f24457d83a33c1ab49047ef50763a661a49d7a76d3e5432aaaf1f49069aa_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:5b3e6ccda0bee467ccb3f27cf79436d587eb15e94caa51ec1220f6de75057569_amd64", "Red Hat Web Terminal 1.16:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:82a2d74f96fee61e60a4ea90b56502032d05527cf0f498ebf81b91048cab8d95_amd64" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution"
  } ]
}