VDB
RHSA-2026:0685
RHSA-2026:0685
PUBLISHED
CVSS 2.700000047683716 LOW
A vulnerability was found in Python/CPython that does not disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols(), which is an invalid value for the underlying OpenSSL API. This issue results in a buffer over-read when NPN is used. See CVE -2024-5535 for OpenSSL for more information.
Risk Scores
CVSS 3.1
2.700000047683716
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhui5/installer-rhel9@sha256:e1d64fbd0e4b90259d9fbb94736ed74c7c384d13067c6bbbb107c664683cb1a9_amd64 as a component of Red Hat Update Infrastructure 5 | * |
| Red Hat | registry.redhat.io/rhui5/rhua-rhel9@sha256:4642951a6a57511f8b481a6481fcd417fc7f3de86511cdab28b9b89639c2bdb2_amd64 as a component of Red Hat Update Infrastructure 5 | * |
| Red Hat | registry.redhat.io/rhui5/cds-rhel9@sha256:87d268fd03fa0063620a043b43bce078144e06849ca6b83fd0e375c13ecb15be_amd64 as a component of Red Hat Update Infrastructure 5 | * |
| Red Hat | registry.redhat.io/rhui5/haproxy-rhel9@sha256:c0cb48d44556c064626eab0d70e5f427ac132bbd921342dcb862267413bf8d16_amd64 as a component of Red Hat Update Infrastructure 5 | * |
Timeline
- Jan 15, 2026 CVE Published
- Aug 2, 2026 CVE Updated
- Aug 2, 2026 Distribution Patch
- Aug 2, 2026 Distribution Patch
- Aug 2, 2026 Security Advisory
- Aug 2, 2026 Security Advisory
- Aug 2, 2026 Security Advisory
- Aug 2, 2026 Security Advisory
- Aug 2, 2026 Security Advisory
- Aug 2, 2026 Security Advisory
- Aug 2, 2026 Security Advisory
- Aug 2, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:0685 advisory
- https://access.redhat.com/products/red-hat-update-infrastructure advisory
- https://access.redhat.com/security/cve/CVE-2024-5642 advisory
- https://access.redhat.com/security/cve/CVE-2025-11083 advisory
- https://access.redhat.com/security/cve/CVE-2025-45582 advisory
- https://access.redhat.com/security/cve/CVE-2025-6069 advisory
- https://access.redhat.com/security/cve/CVE-2025-6075 advisory
- https://access.redhat.com/security/cve/CVE-2025-61984 advisory
- https://access.redhat.com/security/cve/CVE-2025-61985 advisory
- https://access.redhat.com/security/cve/CVE-2025-8291 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/5 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0685.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2294682 issue
- https://www.cve.org/CVERecord?id=CVE-2024-5642 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-5642 advisory
- https://mail.python.org/archives/list/security-announce@python.org/thread/PLP2JI3PJY33YG6P5BZYSSNU66HASXBQ/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2373234 issue
- https://www.cve.org/CVERecord?id=CVE-2025-6069 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-6069 advisory
…and 44 more