{"id":"RHLW-2026-99869c1cad4574fc","summary":"Lightwell Security Advisory: netty-codec-http 4.1.100.Final-rhlw-00001","details":"Red Hat Lightwell has released io.netty:netty-codec-http 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-29025, CVE-2025-58056, CVE-2025-67735, CVE-2026-33870, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-50020, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, and CVE-2026-59921.\n\nCVE-2024-29025: Netty HttpPostRequestDecoder can OOM\n\nCVE-2025-58056: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions\n\nCVE-2025-67735: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder\n\nCVE-2026-33870: Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing\n\nCVE-2026-41417: Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()\n\nCVE-2026-42580: Netty: HTTP Request Smuggling due to incorrect chunk size parsing\n\nCVE-2026-42581: Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization\n\nCVE-2026-42584: Netty: HttpClientCodec response desynchronization\n\nCVE-2026-42585: Netty: HTTP Request Smuggling due to malformed Transfer-Encoding\n\nCVE-2026-42587: Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS\n\nCVE-2026-50020: Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted\n\nCVE-2026-55831: Netty SPDY SETTINGS frame count materializes unbounded settings map\n\nCVE-2026-55833: Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation\n\nCVE-2026-56745: Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion\n\nCVE-2026-56746: Netty has a Security Control Bypass via CORS Short-Circuit Failure\n\nCVE-2026-59898: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation\n\nCVE-2026-59899: Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service\n\nCVE-2026-59903: Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite\n\nCVE-2026-59921: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder\n\nThis patched artifact is a drop-in replacement for io.netty:netty-codec-http 4.1.100.Final from Maven Central.","modified":"2026-10-22T00:08:38.366421100Z","published":"2026-10-12T16:55:52Z","upstream":["CVE-2024-29025","CVE-2025-58056","CVE-2025-67735","CVE-2026-33870","CVE-2026-41417","CVE-2026-42580","CVE-2026-42581","CVE-2026-42584","CVE-2026-42585","CVE-2026-42587","CVE-2026-50020","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56746","CVE-2026-59898","CVE-2026-59899","CVE-2026-59903","CVE-2026-59921","GHSA-38f8-5428-x5cv","GHSA-4mp9-239f-g9hg","GHSA-57rv-r2g8-2cj3","GHSA-5jpm-x58v-624v","GHSA-6cqp-g7gg-8hr5","GHSA-6jqx-86gh-f27w","GHSA-84h7-rjj3-6jx4","GHSA-8c42-7qj2-3j46","GHSA-f6hv-jmp6-3vwv","GHSA-fghv-69vj-qj49","GHSA-gcjf-9mgh-3p7g","GHSA-hvcg-qmg6-jm4c","GHSA-jppx-w49h-x2qq","GHSA-m4cv-j2px-7723","GHSA-mvh2-crg5-v77c","GHSA-pwqr-wmgm-9rr8","GHSA-q4f6-jm68-57ww","GHSA-v8h7-rr48-vmmv","GHSA-xxqh-mfjm-7mv9"],"references":[{"type":"WEB","url":"https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29025.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025"},{"type":"FIX","url":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5jpm-x58v-624v"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58056.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58056"},{"type":"REPORT","url":"https://github.com/JLLeitschuh/unCVEed/issues/1"},{"type":"REPORT","url":"https://github.com/netty/netty/issues/15522"},{"type":"FIX","url":"https://github.com/netty/netty/commit/edb55fd8e0a3bcbd85881e423464f585183d1284"},{"type":"FIX","url":"https://github.com/netty/netty/pull/15611"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fghv-69vj-qj49"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67735.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67735"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-84h7-rjj3-6jx4"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10175"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13571"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14272"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14276"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17668"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17789"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18054"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18055"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18059"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22619"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34608"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7109"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7380"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8159"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8509"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-33870"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33870.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41417.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41417"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-v8h7-rr48-vmmv"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42580.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42580"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-m4cv-j2px-7723"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42581.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23808"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24502"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25123"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28010"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36820"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37390"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:49700"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:49701"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53644"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53645"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53646"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54435"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-42581"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42581.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42581"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xxqh-mfjm-7mv9"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-42584"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42584.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42585.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42585"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-38f8-5428-x5cv"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50085"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-42587"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42587.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv"},{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"},{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50020.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50020"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hvcg-qmg6-jm4c"},{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"},{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55831.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831"},{"type":"FIX","url":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"type":"FIX","url":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6jqx-86gh-f27w"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55833.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mvh2-crg5-v77c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56745.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jppx-w49h-x2qq"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56746.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56746"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6cqp-g7gg-8hr5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59898.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59898"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4mp9-239f-g9hg"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59899.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q4f6-jm68-57ww"},{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"},{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59903.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903"},{"type":"FIX","url":"https://github.com/netty/netty/pull/17213"},{"type":"FIX","url":"https://github.com/netty/netty/pull/17217"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8c42-7qj2-3j46"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59921.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59921"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gcjf-9mgh-3p7g"}],"affected":[{"package":{"name":"io.netty:netty-codec-http","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/io.netty/netty-codec-http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final-rhlw-00001"}]}],"versions":["4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Alpha4","4.0.0.Alpha5","4.0.0.Alpha6","4.0.0.Alpha7","4.0.0.Alpha8","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.37.Final","4.0.38.Final","4.0.39.Final","4.0.4.Final","4.0.40.Final","4.0.41.Final","4.0.42.Final","4.0.43.Final","4.0.44.Final","4.0.45.Final","4.0.46.Final","4.0.47.Final","4.0.48.Final","4.0.49.Final","4.0.5.Final","4.0.50.Final","4.0.51.Final","4.0.52.Final","4.0.53.Final","4.0.54.Final","4.0.55.Final","4.0.56.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final","4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"],"database_specific":{"lightwell":{"backport_base_version":"4.1.100.Final","remediated_version":"4.1.100.Final-rhlw-00001","repository_url":"https://packages.redhat.com/lightwell/java/remediated/"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-99869c1cad4574fc.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}