{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated container images that fix multiple bugs are now available for LVMS 4.19",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "After a successful LVMS upgrade, the latest lvms-operator SHA image should be running.\n\nThis erratum implements the following changes:\n\n- Golang version bump to address CVE-2026-56860.\n\nUsers of LVMS are advised to upgrade to the latest version in OpenShift Container Platform, which fixes these bugs and adds these enhancements.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:94587",
        "url": "https://access.redhat.com/errata/RHSA-2026:94587"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94587.json"
      }
    ],
    "title": "Red Hat Security Advisory: LVMS 4.19 Bug Fix and Enhancement update",
    "tracking": {
      "current_release_date": "2026-11-04T14:12:39+00:00",
      "generator": {
        "date": "2026-11-04T14:12:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:94587",
      "initial_release_date": "2026-11-03T15:13:59+00:00",
      "revision_history": [
        {
          "date": "2026-11-03T15:13:59+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-03T15:14:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-04T14:12:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Logical Volume Manager Storage 4.19",
                "product": {
                  "name": "Logical Volume Manager Storage 4.19",
                  "product_id": "Logical Volume Manager Storage 4.19",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:lvms:4.19::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Logical Volume Manager Storage"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:4d2b9cf0cafea3367e84c3cb63943b2a423d8a97faa5f9153b908d7564f99f03_amd64",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:4d2b9cf0cafea3367e84c3cb63943b2a423d8a97faa5f9153b908d7564f99f03_amd64",
                  "product_id": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:4d2b9cf0cafea3367e84c3cb63943b2a423d8a97faa5f9153b908d7564f99f03_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256%3A4d2b9cf0cafea3367e84c3cb63943b2a423d8a97faa5f9153b908d7564f99f03?arch=amd64&repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator&tag=1793362268"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-operator-bundle@sha256:8adbcfa0e5343b94cb51cc41c25de1a9a9c4432c76165637b03f6f888dbd4e49_amd64",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-operator-bundle@sha256:8adbcfa0e5343b94cb51cc41c25de1a9a9c4432c76165637b03f6f888dbd4e49_amd64",
                  "product_id": "registry.redhat.io/lvms4/lvms-operator-bundle@sha256:8adbcfa0e5343b94cb51cc41c25de1a9a9c4432c76165637b03f6f888dbd4e49_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256%3A8adbcfa0e5343b94cb51cc41c25de1a9a9c4432c76165637b03f6f888dbd4e49?arch=amd64&repository_url=registry.redhat.io/lvms4/lvms-operator-bundle&tag=1793366328"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:c9f37aabb755d9b961ee0b386fbc0572397bc6c4bdbae50405d02e74f1d7b4c3_amd64",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:c9f37aabb755d9b961ee0b386fbc0572397bc6c4bdbae50405d02e74f1d7b4c3_amd64",
                  "product_id": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:c9f37aabb755d9b961ee0b386fbc0572397bc6c4bdbae50405d02e74f1d7b4c3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256%3Ac9f37aabb755d9b961ee0b386fbc0572397bc6c4bdbae50405d02e74f1d7b4c3?arch=amd64&repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9&tag=1793362329"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:b163e6c6200a3fa266236f8cb80c7e811da3ff6c278aeff4338cb41658ddced1_arm64",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:b163e6c6200a3fa266236f8cb80c7e811da3ff6c278aeff4338cb41658ddced1_arm64",
                  "product_id": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:b163e6c6200a3fa266236f8cb80c7e811da3ff6c278aeff4338cb41658ddced1_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256%3Ab163e6c6200a3fa266236f8cb80c7e811da3ff6c278aeff4338cb41658ddced1?arch=arm64&repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator&tag=1793362268"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:5590ad2abbb26a33f4ccc7d5730163ebf38659ef6924ad0d7e8a80ee78fc1b9f_arm64",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:5590ad2abbb26a33f4ccc7d5730163ebf38659ef6924ad0d7e8a80ee78fc1b9f_arm64",
                  "product_id": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:5590ad2abbb26a33f4ccc7d5730163ebf38659ef6924ad0d7e8a80ee78fc1b9f_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256%3A5590ad2abbb26a33f4ccc7d5730163ebf38659ef6924ad0d7e8a80ee78fc1b9f?arch=arm64&repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9&tag=1793362329"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:d20b95439cea583d28763d01c243c9e6a0c9b8c0555a8a08311c35aed6742ca5_ppc64le",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:d20b95439cea583d28763d01c243c9e6a0c9b8c0555a8a08311c35aed6742ca5_ppc64le",
                  "product_id": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:d20b95439cea583d28763d01c243c9e6a0c9b8c0555a8a08311c35aed6742ca5_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256%3Ad20b95439cea583d28763d01c243c9e6a0c9b8c0555a8a08311c35aed6742ca5?arch=ppc64le&repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator&tag=1793362268"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:2029b8796fdd78c81146970a477817de936900e41ec0e1bb75f1158b70cba9c7_ppc64le",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:2029b8796fdd78c81146970a477817de936900e41ec0e1bb75f1158b70cba9c7_ppc64le",
                  "product_id": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:2029b8796fdd78c81146970a477817de936900e41ec0e1bb75f1158b70cba9c7_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256%3A2029b8796fdd78c81146970a477817de936900e41ec0e1bb75f1158b70cba9c7?arch=ppc64le&repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9&tag=1793362329"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:611c48a745ceb6b66242a4ee16fe01f6601aaf85a98f875bb9bacbd16da55c43_s390x",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:611c48a745ceb6b66242a4ee16fe01f6601aaf85a98f875bb9bacbd16da55c43_s390x",
                  "product_id": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:611c48a745ceb6b66242a4ee16fe01f6601aaf85a98f875bb9bacbd16da55c43_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256%3A611c48a745ceb6b66242a4ee16fe01f6601aaf85a98f875bb9bacbd16da55c43?arch=s390x&repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator&tag=1793362268"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:d6822aafb911350e06cb296069731d94323facff44be76686ca42bbe0eee8813_s390x",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:d6822aafb911350e06cb296069731d94323facff44be76686ca42bbe0eee8813_s390x",
                  "product_id": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:d6822aafb911350e06cb296069731d94323facff44be76686ca42bbe0eee8813_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256%3Ad6822aafb911350e06cb296069731d94323facff44be76686ca42bbe0eee8813?arch=s390x&repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9&tag=1793362329"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:2029b8796fdd78c81146970a477817de936900e41ec0e1bb75f1158b70cba9c7_ppc64le as a component of Logical Volume Manager Storage 4.19",
          "product_id": "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:2029b8796fdd78c81146970a477817de936900e41ec0e1bb75f1158b70cba9c7_ppc64le"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:2029b8796fdd78c81146970a477817de936900e41ec0e1bb75f1158b70cba9c7_ppc64le",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:5590ad2abbb26a33f4ccc7d5730163ebf38659ef6924ad0d7e8a80ee78fc1b9f_arm64 as a component of Logical Volume Manager Storage 4.19",
          "product_id": "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:5590ad2abbb26a33f4ccc7d5730163ebf38659ef6924ad0d7e8a80ee78fc1b9f_arm64"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:5590ad2abbb26a33f4ccc7d5730163ebf38659ef6924ad0d7e8a80ee78fc1b9f_arm64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:c9f37aabb755d9b961ee0b386fbc0572397bc6c4bdbae50405d02e74f1d7b4c3_amd64 as a component of Logical Volume Manager Storage 4.19",
          "product_id": "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:c9f37aabb755d9b961ee0b386fbc0572397bc6c4bdbae50405d02e74f1d7b4c3_amd64"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:c9f37aabb755d9b961ee0b386fbc0572397bc6c4bdbae50405d02e74f1d7b4c3_amd64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:d6822aafb911350e06cb296069731d94323facff44be76686ca42bbe0eee8813_s390x as a component of Logical Volume Manager Storage 4.19",
          "product_id": "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:d6822aafb911350e06cb296069731d94323facff44be76686ca42bbe0eee8813_s390x"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:d6822aafb911350e06cb296069731d94323facff44be76686ca42bbe0eee8813_s390x",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-operator-bundle@sha256:8adbcfa0e5343b94cb51cc41c25de1a9a9c4432c76165637b03f6f888dbd4e49_amd64 as a component of Logical Volume Manager Storage 4.19",
          "product_id": "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:8adbcfa0e5343b94cb51cc41c25de1a9a9c4432c76165637b03f6f888dbd4e49_amd64"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-operator-bundle@sha256:8adbcfa0e5343b94cb51cc41c25de1a9a9c4432c76165637b03f6f888dbd4e49_amd64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:4d2b9cf0cafea3367e84c3cb63943b2a423d8a97faa5f9153b908d7564f99f03_amd64 as a component of Logical Volume Manager Storage 4.19",
          "product_id": "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:4d2b9cf0cafea3367e84c3cb63943b2a423d8a97faa5f9153b908d7564f99f03_amd64"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:4d2b9cf0cafea3367e84c3cb63943b2a423d8a97faa5f9153b908d7564f99f03_amd64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:611c48a745ceb6b66242a4ee16fe01f6601aaf85a98f875bb9bacbd16da55c43_s390x as a component of Logical Volume Manager Storage 4.19",
          "product_id": "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:611c48a745ceb6b66242a4ee16fe01f6601aaf85a98f875bb9bacbd16da55c43_s390x"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:611c48a745ceb6b66242a4ee16fe01f6601aaf85a98f875bb9bacbd16da55c43_s390x",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:b163e6c6200a3fa266236f8cb80c7e811da3ff6c278aeff4338cb41658ddced1_arm64 as a component of Logical Volume Manager Storage 4.19",
          "product_id": "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:b163e6c6200a3fa266236f8cb80c7e811da3ff6c278aeff4338cb41658ddced1_arm64"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:b163e6c6200a3fa266236f8cb80c7e811da3ff6c278aeff4338cb41658ddced1_arm64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:d20b95439cea583d28763d01c243c9e6a0c9b8c0555a8a08311c35aed6742ca5_ppc64le as a component of Logical Volume Manager Storage 4.19",
          "product_id": "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:d20b95439cea583d28763d01c243c9e6a0c9b8c0555a8a08311c35aed6742ca5_ppc64le"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:d20b95439cea583d28763d01c243c9e6a0c9b8c0555a8a08311c35aed6742ca5_ppc64le",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.19"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:2029b8796fdd78c81146970a477817de936900e41ec0e1bb75f1158b70cba9c7_ppc64le",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:5590ad2abbb26a33f4ccc7d5730163ebf38659ef6924ad0d7e8a80ee78fc1b9f_arm64",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:c9f37aabb755d9b961ee0b386fbc0572397bc6c4bdbae50405d02e74f1d7b4c3_amd64",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:d6822aafb911350e06cb296069731d94323facff44be76686ca42bbe0eee8813_s390x",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:8adbcfa0e5343b94cb51cc41c25de1a9a9c4432c76165637b03f6f888dbd4e49_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments ('..') may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:4d2b9cf0cafea3367e84c3cb63943b2a423d8a97faa5f9153b908d7564f99f03_amd64",
          "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:611c48a745ceb6b66242a4ee16fe01f6601aaf85a98f875bb9bacbd16da55c43_s390x",
          "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:b163e6c6200a3fa266236f8cb80c7e811da3ff6c278aeff4338cb41658ddced1_arm64",
          "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:d20b95439cea583d28763d01c243c9e6a0c9b8c0555a8a08311c35aed6742ca5_ppc64le"
        ],
        "known_not_affected": [
          "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:2029b8796fdd78c81146970a477817de936900e41ec0e1bb75f1158b70cba9c7_ppc64le",
          "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:5590ad2abbb26a33f4ccc7d5730163ebf38659ef6924ad0d7e8a80ee78fc1b9f_arm64",
          "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:c9f37aabb755d9b961ee0b386fbc0572397bc6c4bdbae50405d02e74f1d7b4c3_amd64",
          "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:d6822aafb911350e06cb296069731d94323facff44be76686ca42bbe0eee8813_s390x",
          "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:8adbcfa0e5343b94cb51cc41c25de1a9a9c4432c76165637b03f6f888dbd4e49_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-03T15:13:59+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:4d2b9cf0cafea3367e84c3cb63943b2a423d8a97faa5f9153b908d7564f99f03_amd64",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:611c48a745ceb6b66242a4ee16fe01f6601aaf85a98f875bb9bacbd16da55c43_s390x",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:b163e6c6200a3fa266236f8cb80c7e811da3ff6c278aeff4338cb41658ddced1_arm64",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:d20b95439cea583d28763d01c243c9e6a0c9b8c0555a8a08311c35aed6742ca5_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94587"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:2029b8796fdd78c81146970a477817de936900e41ec0e1bb75f1158b70cba9c7_ppc64le",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:5590ad2abbb26a33f4ccc7d5730163ebf38659ef6924ad0d7e8a80ee78fc1b9f_arm64",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:c9f37aabb755d9b961ee0b386fbc0572397bc6c4bdbae50405d02e74f1d7b4c3_amd64",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:d6822aafb911350e06cb296069731d94323facff44be76686ca42bbe0eee8813_s390x",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:8adbcfa0e5343b94cb51cc41c25de1a9a9c4432c76165637b03f6f888dbd4e49_amd64",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:4d2b9cf0cafea3367e84c3cb63943b2a423d8a97faa5f9153b908d7564f99f03_amd64",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:611c48a745ceb6b66242a4ee16fe01f6601aaf85a98f875bb9bacbd16da55c43_s390x",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:b163e6c6200a3fa266236f8cb80c7e811da3ff6c278aeff4338cb41658ddced1_arm64",
            "Logical Volume Manager Storage 4.19:registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:d20b95439cea583d28763d01c243c9e6a0c9b8c0555a8a08311c35aed6742ca5_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    }
  ]
}