{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-33490", "tracking": { "current_release_date": "2026-03-31T21:26:50.213886Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-33490", "initial_release_date": "2026-03-20T21:41:01.501625Z", "revision_history": [ { "date": "2026-03-20T21:41:01.501625Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-20T21:41:06.291247Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-26T17:38:42.254943Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)." }, { "date": "2026-03-26T17:38:44.764902Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-26T18:26:58.787525Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)." }, { "date": "2026-03-26T18:27:00.318674Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-03-26T18:38:45.094718Z", "number": "7", "summary": "Unknown change." }, { "date": "2026-03-27T00:27:37.055210Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (10).| Product Identifiers created (2).| References created (3).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-03-27T00:27:41.824110Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-03-27T20:56:56.723824Z", "number": "10", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-27T20:57:03.052820Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-03-28T07:58:06.340109Z", "number": "12", "summary": "References created (1)." }, { "date": "2026-03-31T21:25:06.327696Z", "number": "13", "summary": "Products connected (14).| Product Identifiers created (16).| Products created (2).| Exploits created (1)." }, { "date": "2026-03-31T21:25:18.705885Z", "number": "14", "summary": "NCSC Score updated." } ], "status": "interim", "version": "14" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/5", "product": { "name": "vers:rpm/5", "product_id": "CSAFPID-1459353", "product_identification_helper": { "cpe": "cpe:/a:redhat:logging:5" } } } ], "category": "product_name", "name": "Logging Subsystem for Red Hat OpenShift" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/5", "product": { "name": "vers:rpm/5", "product_id": "CSAFPID-2552051", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_update_service:5" } } } ], "category": "product_name", "name": "Red Hat OpenShift Update Service" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-3010673" } } ], "category": "product_name", "name": "cluster-logging-operator-bundle" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1496167" } } ], "category": "product_name", "name": "cluster-logging-rhel9-operator" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2485093" } } ], "category": "product_name", "name": "eventrouter-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2821638" } } ], "category": "product_name", "name": "fluentd-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2914700" } } ], "category": "product_name", "name": "log-file-metric-exporter-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2914698" } } ], "category": "product_name", "name": "logging-view-plugin-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-3010674" } } ], "category": "product_name", "name": "vector-rhel9" } ], "category": "product_family", "name": "Logging Subsystem for Red Hat OpenShift" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5351993" } } ], "category": "product_name", "name": "openshift-update-service-rhel8" } ], "category": "product_family", "name": "Red Hat OpenShift Update Service" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc1", "product": { "name": "vers:unknown/2.0.1-rc1", "product_id": "CSAFPID-5875819", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc1:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc10", "product": { "name": "vers:unknown/2.0.1-rc10", "product_id": "CSAFPID-5875830", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc10:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc11", "product": { "name": "vers:unknown/2.0.1-rc11", "product_id": "CSAFPID-5875831", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc11:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc12", "product": { "name": "vers:unknown/2.0.1-rc12", "product_id": "CSAFPID-5875832", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc12:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc13", "product": { "name": "vers:unknown/2.0.1-rc13", "product_id": "CSAFPID-5875833", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc13:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc14", "product": { "name": "vers:unknown/2.0.1-rc14", "product_id": "CSAFPID-5875834", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc14:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc15", "product": { "name": "vers:unknown/2.0.1-rc15", "product_id": "CSAFPID-5969599", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc15:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc16", "product": { "name": "vers:unknown/2.0.1-rc16", "product_id": "CSAFPID-5969600", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc16:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc2", "product": { "name": "vers:unknown/2.0.1-rc2", "product_id": "CSAFPID-5875820", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc3", "product": { "name": "vers:unknown/2.0.1-rc3", "product_id": "CSAFPID-5875821", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc4", "product": { "name": "vers:unknown/2.0.1-rc4", "product_id": "CSAFPID-5875822", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc5", "product": { "name": "vers:unknown/2.0.1-rc5", "product_id": "CSAFPID-5875823", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc6", "product": { "name": "vers:unknown/2.0.1-rc6", "product_id": "CSAFPID-5875824", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc7", "product": { "name": "vers:unknown/2.0.1-rc7", "product_id": "CSAFPID-5875825", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc8", "product": { "name": "vers:unknown/2.0.1-rc8", "product_id": "CSAFPID-5875826", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc9", "product": { "name": "vers:unknown/2.0.1-rc9", "product_id": "CSAFPID-5875835", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc9:*:*:*:node.js:*:*" } } } ], "category": "product_name", "name": "h3" } ], "category": "vendor", "name": "h3" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=2.0.1-alpha.0|<2.0.1-rc.17", "product": { "name": "vers:unknown/>=2.0.1-alpha.0|<2.0.1-rc.17", "product_id": "CSAFPID-5918248" } } ], "category": "product_name", "name": "h3" } ], "category": "vendor", "name": "h3js" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-33490", "cwe": { "id": "CWE-706", "name": "Use of Incorrectly-Resolved Name or Reference" }, "notes": [ { "category": "description", "text": "## Summary\n\nThe `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags.\n\n## Details\n\nThe root cause is in `src/h3.ts:127` within the `mount()` method:\n\n```typescript\n// src/h3.ts:122-135\nmount(base: string, input: FetchHandler | FetchableObject | H3Type) {\n if (\"handler\" in input) {\n if (input[\"~middleware\"].length > 0) {\n this[\"~middleware\"].push((event, next) => {\n const originalPathname = event.url.pathname;\n if (!originalPathname.startsWith(base)) { // <-- BUG: no segment boundary check\n return next();\n }\n event.url.pathname = event.url.pathname.slice(base.length) || \"/\";\n return callMiddleware(event, input[\"~middleware\"], () => {\n event.url.pathname = originalPathname;\n return next();\n });\n });\n }\n```\n\nWhen a sub-app is mounted at `/admin`, the check `originalPathname.startsWith(\"/admin\")` returns `true` for `/admin`, `/admin/`, `/admin/dashboard`, but also for `/admin-public`, `/administrator`, `/adminFoo`, etc. The mounted sub-app's entire middleware chain then executes for these unrelated paths.\n\nA secondary instance of the same flaw exists in `src/utils/internal/path.ts:40`:\n\n```typescript\n// src/utils/internal/path.ts:35-45\nexport function withoutBase(input: string = \"\", base: string = \"\"): string {\n if (!base || base === \"/\") {\n return input;\n }\n const _base = withoutTrailingSlash(base);\n if (!input.startsWith(_base)) { // <-- Same flaw: no segment boundary check\n return input;\n }\n const trimmed = input.slice(_base.length);\n return trimmed[0] === \"/\" ? trimmed : \"/\" + trimmed;\n}\n```\n\nThe `withoutBase()` utility will incorrectly strip the base from paths that merely share a string prefix, returning mangled paths (e.g., `withoutBase(\"/admin-public/info\", \"/admin\")` returns `/-public/info`).\n\n**Exploitation flow:**\n\n1. Developer mounts a sub-app at `/admin` with middleware that sets `event.context.isAdmin = true`\n2. Developer defines a separate route `/admin-public/info` on the parent app that reads `event.context.isAdmin`\n3. Attacker requests `GET /admin-public/info`\n4. The `/admin` mount's `startsWith` check passes → admin middleware executes → sets `isAdmin = true`\n5. The middleware's \"restore pathname\" callback fires, control returns to the parent app\n6. The `/admin-public/info` handler sees `event.context.isAdmin === true`\n\n## PoC\n\n```javascript\n// poc.js — demonstrates context pollution across mount boundaries\nimport { H3 } from \"h3\";\n\nconst adminApp = new H3();\n\n// Admin middleware sets privileged context\nadminApp.use(() => {}, {\n onRequest: (event) => {\n event.context.isAdmin = true;\n }\n});\n\nadminApp.get(\"/dashboard\", (event) => {\n return { admin: true, context: event.context };\n});\n\nconst app = new H3();\n\n// Mount admin sub-app at /admin\napp.mount(\"/admin\", adminApp);\n\n// Public route that happens to share the \"/admin\" prefix\napp.get(\"/admin-public/info\", (event) => {\n return {\n path: event.url.pathname,\n isAdmin: event.context.isAdmin ?? false, // Should always be false here\n };\n});\n\n// Test with fetch\nconst server = Bun.serve({ port: 3000, fetch: app.fetch });\n\n// This request should NOT trigger admin middleware, but it does\nconst res = await fetch(\"http://localhost:3000/admin-public/info\");\nconst body = await res.json();\nconsole.log(body);\n// Actual output: { path: \"/admin-public/info\", isAdmin: true }\n// Expected output: { path: \"/admin-public/info\", isAdmin: false }\n\nserver.stop();\n```\n\n**Steps to reproduce:**\n\n```bash\n# 1. Clone h3 and install\ngit clone https://github.com/h3js/h3 && cd h3\ncorepack enable && pnpm install && pnpm build\n\n# 2. Save poc.js (above) and run\nbun poc.js\n# Output shows isAdmin: true — admin middleware leaked to /admin-public/info\n\n# 3. Verify the boundary leak with additional paths:\n# GET /administrator → admin middleware fires\n# GET /adminstuff → admin middleware fires\n# GET /admin123 → admin middleware fires\n# GET /admi → admin middleware does NOT fire (correct)\n```\n\n## Impact\n\n- **Context pollution across mount boundaries**: Middleware registered on a mounted sub-app executes for any route sharing the string prefix, not just routes under the intended path segment tree. This can set privileged flags (`isAdmin`, `isAuthenticated`, role assignments) on requests to completely unrelated routes.\n- **Authorization bypass**: If an application uses mount-scoped middleware to set permissive context flags and other routes check those flags, an attacker can access protected functionality by requesting a path that string-prefix-matches the mount base but routes to a different handler.\n- **Path mangling**: The `withoutBase()` utility produces incorrect paths (e.g., `/-public/info` instead of `/admin-public/info`) when the input shares only a string prefix, potentially causing routing errors or further security issues in downstream path processing.\n- **Scope**: Any h3 v2 application using `mount()` with a base path that is a string prefix of other routes is affected. The impact scales with how the application uses middleware-set context values.\n\n## Recommended Fix\n\nAdd a segment boundary check after the `startsWith` call in both locations. The character immediately following the base prefix must be `/`, `?`, `#`, or the string must end exactly at the base:\n\n**Fix for `src/h3.ts:127`:**\n\n```diff\n mount(base: string, input: FetchHandler | FetchableObject | H3Type) {\n if (\"handler\" in input) {\n if (input[\"~middleware\"].length > 0) {\n this[\"~middleware\"].push((event, next) => {\n const originalPathname = event.url.pathname;\n- if (!originalPathname.startsWith(base)) {\n+ if (!originalPathname.startsWith(base) ||\n+ (originalPathname.length > base.length && originalPathname[base.length] !== \"/\")) {\n return next();\n }\n```\n\n**Fix for `src/utils/internal/path.ts:40`:**\n\n```diff\n export function withoutBase(input: string = \"\", base: string = \"\"): string {\n if (!base || base === \"/\") {\n return input;\n }\n const _base = withoutTrailingSlash(base);\n- if (!input.startsWith(_base)) {\n+ if (!input.startsWith(_base) ||\n+ (input.length > _base.length && input[_base.length] !== \"/\")) {\n return input;\n }\n```\n\nThis ensures that `/admin` only matches `/admin`, `/admin/`, and `/admin/...` — never `/admin-public`, `/administrator`, or other coincidental string-prefix matches.", "title": "github - https://api.github.com/advisories/GHSA-2j6q-whv2-gh6w" }, { "category": "description", "text": "H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33490.json" }, { "category": "description", "text": "H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33490" }, { "category": "description", "text": "A flaw was found in H3, a minimal HTTP framework. The `mount()` method, responsible for routing requests to sub-applications, incorrectly uses a simple string comparison to check path prefixes. This allows a remote attacker to craft a URL that bypasses the intended path segment boundary. Consequently, middleware designed for specific administrative paths could be triggered for unrelated public paths, potentially leading to the exposure of sensitive information or unintended access due to incorrect privilege flags being set in the request context.\nA Moderate flaw in the `h3` framework's `mount()` method allows for incorrect path prefix validation. This can lead to middleware intended for specific administrative paths being triggered for unrelated public paths, potentially exposing sensitive information or granting unintended access. Red Hat OpenShift Container Platform components are not affected as the vulnerable code is not present. Fedora versions 42 and 43 are affected.", "title": "redhat - https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33490.json" }, { "category": "other", "text": "0.00029", "title": "EPSS" }, { "category": "other", "text": "3.6", "title": "NCSC Score" }, { "category": "other", "text": "There is cvss data available from source Redhat", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "There is exploit data available from source Nvd, Is related to (a version of) an uncommon product, The value of the most recent CVSS (V3) score", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 2\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-5918248", "CSAFPID-5875819", "CSAFPID-5875820", "CSAFPID-5875821", "CSAFPID-5875822", "CSAFPID-5875823", "CSAFPID-5875824", "CSAFPID-5875825", "CSAFPID-5875826", "CSAFPID-5875830", "CSAFPID-5875831", "CSAFPID-5875832", "CSAFPID-5875833", "CSAFPID-5875834", "CSAFPID-5875835", "CSAFPID-5969599", "CSAFPID-5969600" ], "known_not_affected": [ "CSAFPID-1459353", "CSAFPID-1496167", "CSAFPID-2485093", "CSAFPID-2552051", "CSAFPID-2821638", "CSAFPID-2914698", "CSAFPID-2914700", "CSAFPID-3010673", "CSAFPID-3010674", "CSAFPID-5351993" ] }, "references": [ { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-2j6q-whv2-gh6w" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33490.json" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33490" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33490.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; redhat", "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-2j6q-whv2-gh6w" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33490" }, { "category": "external", "summary": "Reference - github; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33490" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-5875819", "CSAFPID-5875820", "CSAFPID-5875821", "CSAFPID-5875822", "CSAFPID-5875823", "CSAFPID-5875824", "CSAFPID-5875825", "CSAFPID-5875826", "CSAFPID-5875830", "CSAFPID-5875831", "CSAFPID-5875832", "CSAFPID-5875833", "CSAFPID-5875834", "CSAFPID-5875835", "CSAFPID-5918248", "CSAFPID-5969599", "CSAFPID-5969600" ] } ], "title": "CVE-2026-33490" } ] }