{"schema":"vulnpedia.research/1","cve":"CVE-2026-103262","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp","tags":["vendor-advisory","exploit","WEB","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-01T10:42:04.913Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-01T10:42:04.913Z","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp"},{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-06T00:08:58.078Z","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp"},{"source":"nvd","sourceId":"CVE-2026-103262","modified":"2026-10-06T01:16:32.767","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp"},{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp"},{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp"},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp"}]},{"url":"https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9","tags":["patch","WEB","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-01T10:42:04.913Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-01T10:42:04.913Z","url":"https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9"},{"source":"nvd","sourceId":"CVE-2026-103262","modified":"2026-10-06T01:16:32.767","url":"https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9"},{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","url":"https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9"},{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","url":"https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9"},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9"}]},{"url":"https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient","tags":["third-party-advisory","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-01T10:42:04.913Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-01T10:42:04.913Z","url":"https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient"},{"source":"nvd","sourceId":"CVE-2026-103262","modified":"2026-10-06T01:16:32.767","url":"https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient"},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient"}]},{"url":"https://osv.dev/vulnerability/GHSA-chx6-46f5-w4vp","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","origins":[{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","url":"https://osv.dev/vulnerability/GHSA-chx6-46f5-w4vp"},{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","url":"https://osv.dev/vulnerability/GHSA-chx6-46f5-w4vp"}]},{"url":"https://github.com/tornadoweb/tornado/pull/3719","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","origins":[{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","url":"https://github.com/tornadoweb/tornado/pull/3719"},{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","url":"https://github.com/tornadoweb/tornado/pull/3719"}]},{"url":"https://github.com/tornadoweb/tornado/commit/15f056080d8e456f92cca8ad0c33e5a5480414ac","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","origins":[{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","url":"https://github.com/tornadoweb/tornado/commit/15f056080d8e456f92cca8ad0c33e5a5480414ac"},{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","url":"https://github.com/tornadoweb/tornado/commit/15f056080d8e456f92cca8ad0c33e5a5480414ac"}]},{"url":"https://github.com/tornadoweb/tornado/commit/6564e0a0922c16f239d3a18adccd04736e380c89","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","origins":[{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","url":"https://github.com/tornadoweb/tornado/commit/6564e0a0922c16f239d3a18adccd04736e380c89"},{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","url":"https://github.com/tornadoweb/tornado/commit/6564e0a0922c16f239d3a18adccd04736e380c89"}]},{"url":"https://github.com/tornadoweb/tornado/commit/aa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","origins":[{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","url":"https://github.com/tornadoweb/tornado/commit/aa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4"},{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","url":"https://github.com/tornadoweb/tornado/commit/aa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4"}]},{"url":"https://github.com/tornadoweb/tornado","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","origins":[{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","url":"https://github.com/tornadoweb/tornado"},{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","url":"https://github.com/tornadoweb/tornado"}]},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.9","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","origins":[{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"},{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-103262","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-103262"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544534","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544534"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103262","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-103262"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103262","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103262"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:82041","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://access.redhat.com/errata/RHSA-2026:82041"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:82040","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://access.redhat.com/errata/RHSA-2026:82040"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87120","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87120"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87410","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87410"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:84734","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://access.redhat.com/errata/RHSA-2026:84734"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87124","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87124"}]},{"source":"euvd","sourceId":"EUVD-2026-90656","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90656","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-90656","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90656"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","url":"https://osv.dev/vulnerability/GHSA-chx6-46f5-w4vp","ecosystem":"PyPI","name":"tornado","purl":"pkg:pypi/tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.9"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5","6.5.1","6.5.2","6.5.3","6.5.4","6.5.5","6.5.6","6.5.7","6.5.8","6.5b1"],"databaseSpecific":{"last_known_affected_version_range":"<= 6.5.8","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-chx6-46f5-w4vp/GHSA-chx6-46f5-w4vp.json"},"modified":"2026-10-02T03:56:11.819291984Z","origins":[{"source":"ghsa","sourceId":"GHSA-chx6-46f5-w4vp","modified":"2026-10-02T03:56:11.819291984Z","url":"https://osv.dev/vulnerability/GHSA-chx6-46f5-w4vp"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"AppStream-10.2.Z:python-tornado-0:6.5.10-1.el10_2.1.src","product":"python-tornado-0:6.5.10-1.el10_2.1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:82041"},{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."}],"purl":"pkg:rpm/redhat/python-tornado@6.5.10-1.el10_2.1?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"AppStream-10.2.Z:python-tornado-debugsource-0:6.5.10-1.el10_2.1.x86_64","product":"python-tornado-debugsource-0:6.5.10-1.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:82041"},{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."}],"purl":"pkg:rpm/redhat/python-tornado-debugsource@6.5.10-1.el10_2.1?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"AppStream-10.2.Z:python3-tornado-0:6.5.10-1.el10_2.1.x86_64","product":"python3-tornado-0:6.5.10-1.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:82041"},{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."}],"purl":"pkg:rpm/redhat/python3-tornado@6.5.10-1.el10_2.1?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"AppStream-10.2.Z:python3-tornado-debuginfo-0:6.5.10-1.el10_2.1.x86_64","product":"python3-tornado-debuginfo-0:6.5.10-1.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:82041"},{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."}],"purl":"pkg:rpm/redhat/python3-tornado-debuginfo@6.5.10-1.el10_2.1?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:python-tornado-debugsource-0:6.5.10-1.el9_8.1.s390x","product":"python-tornado-debugsource-0:6.5.10-1.el9_8.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:82040"},{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."}],"purl":"pkg:rpm/redhat/python-tornado-debugsource@6.5.10-1.el9_8.1?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:python3-tornado-0:6.5.10-1.el9_8.1.s390x","product":"python3-tornado-0:6.5.10-1.el9_8.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:82040"},{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."}],"purl":"pkg:rpm/redhat/python3-tornado@6.5.10-1.el9_8.1?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:python3-tornado-debuginfo-0:6.5.10-1.el9_8.1.s390x","product":"python3-tornado-debuginfo-0:6.5.10-1.el9_8.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:82040"},{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."}],"purl":"pkg:rpm/redhat/python3-tornado-debuginfo@6.5.10-1.el9_8.1?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat Ansible Automation Platform 2.6:registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9@sha256:d4c2821fb38e6302a9619334680e0666013ea61f0a24e8995c78b2d2ae681c4c_arm64","product":"registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9@sha256:d4c2821fb38e6302a9619334680e0666013ea61f0a24e8995c78b2d2ae681c4c_arm64 as a component of Red Hat Ansible Automation Platform 2.6","status":"fixed","remediations":[{"category":"vendor_fix","details":"Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","url":"https://access.redhat.com/errata/RHSA-2026:87120"},{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."}],"purl":"pkg:oci/lightspeed-chatbot-rhel9@sha256%3Ad4c2821fb38e6302a9619334680e0666013ea61f0a24e8995c78b2d2ae681c4c?arch=arm64&repository_url=registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9&tag=1791978798","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat OpenShift AI 2.25:registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:1ddd567dacafb048d99459bc862b1cc0cf8e55c8d96c859f6caa81e3e54c730c_amd64","product":"registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:1ddd567dacafb048d99459bc862b1cc0cf8e55c8d96c859f6caa81e3e54c730c_amd64 as a component of Red Hat OpenShift AI 2.25","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 2.25.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:87410"},{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."}],"purl":"pkg:oci/odh-feature-server-rhel9@sha256%3A1ddd567dacafb048d99459bc862b1cc0cf8e55c8d96c859f6caa81e3e54c730c?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1792148523","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:4889829051aba21ec882d8c8912d63494ad9b663102ba441b3ad4cef296b97b7_amd64","product":"registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:4889829051aba21ec882d8c8912d63494ad9b663102ba441b3ad4cef296b97b7_amd64 as a component of Red Hat OpenShift AI 3.4","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."}],"purl":"pkg:oci/odh-feature-server-rhel9@sha256%3A4889829051aba21ec882d8c8912d63494ad9b663102ba441b3ad4cef296b97b7?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1791863220","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-trustyai-nemo-guardrails-server-rhel9@sha256:cb78838fe6b5935912b000b04706a1f4536080f1db4e6dd44a17ff1dc2f7995e_amd64","product":"registry.redhat.io/rhoai/odh-trustyai-nemo-guardrails-server-rhel9@sha256:cb78838fe6b5935912b000b04706a1f4536080f1db4e6dd44a17ff1dc2f7995e_amd64 as a component of Red Hat OpenShift AI 3.4","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."}],"purl":"pkg:oci/odh-trustyai-nemo-guardrails-server-rhel9@sha256%3Acb78838fe6b5935912b000b04706a1f4536080f1db4e6dd44a17ff1dc2f7995e?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-trustyai-nemo-guardrails-server-rhel9&tag=1791556128","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"lightspeed_core:lightspeed-core/lightspeed-stack-rhel9","product":"lightspeed-core/lightspeed-stack-rhel9 as a component of Lightspeed Core","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/lightspeed-stack-rhel9@sha256:4094c9b5601983497b2dac5f0e6b3e1cb8e6094eaab30f05d0a7a535a49c179c?repository_url=registry.redhat.io/lightspeed-core/lightspeed-stack-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9","product":"rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."},{"category":"no_fix_planned","details":"Will not fix"}],"purl":"pkg:oci/bootc-gaudi-rhel9@sha256:e1057b59ca1be9501332abf97230855e85c7df858356be0da9dce230ea7e98e1?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9","product":"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:b65cee70b3abfa45f0e8ed4763f5c55fb48b75410184065b95b429b2b0a4717f?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9","product":"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9@sha256:8d61dd22d1adf0fd7df80a65783e01fc6226e98f14a3ebde9bd5388dd9d21beb?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch210-py312-rhel9","product":"rhoai/odh-th06-cuda130-torch210-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-th06-cuda130-torch210-py312-rhel9@sha256:7f4c4a15b24a0a538de526f305286262bf9784fe7695efae0db3519735deaba4?repository_url=registry.redhat.io/rhoai/odh-th06-cuda130-torch210-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9","product":"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-workbench-jupyter-minimal-cpu-py312-rhel9@sha256:1e8c79265d905315b4e9e11185f8abac06823eb2441bc4e7466bad4e48c84f16?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9","product":"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-workbench-jupyter-pytorch-rocm-py312-rhel9@sha256:0708626cd3b96dfb6a7bef4085872dc131b64340112c40f7c70e7139882e5412?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"red_hat_openstack_platform_16.2:rhosp-rhel8/openstack-cinder-backup","product":"rhosp-rhel8/openstack-cinder-backup as a component of Red Hat OpenStack Platform 16.2","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/openstack-cinder-backup@sha256:2ea0f1758551777be62b1c42c4f23b2fee1e172cf8e5bfb7986bcae3fd940e22?repository_url=registry.redhat.io/rhosp-rhel8/openstack-cinder-backup","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"red_hat_openstack_platform_16.2:rhosp-rhel8/openstack-ovn-northd","product":"rhosp-rhel8/openstack-ovn-northd as a component of Red Hat OpenStack Platform 16.2","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/openstack-ovn-northd@sha256:2022f438013b066b8d02b4d568b4549dfc725c88291cd7e6ba0441c42e39e234?repository_url=registry.redhat.io/rhosp-rhel8/openstack-ovn-northd","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"red_hat_openstack_platform_17.1:rhosp-rhel9/openstack-haproxy","product":"rhosp-rhel9/openstack-haproxy as a component of Red Hat OpenStack Platform 17.1","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/openstack-haproxy@sha256:f8e6031167299543d3dc6144b7203b2726394c1a00ec59de329de38f670da9c7?repository_url=registry.redhat.io/rhosp-rhel9/openstack-haproxy","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"red_hat_openstack_platform_17.1:rhosp-rhel9/openstack-redis","product":"rhosp-rhel9/openstack-redis as a component of Red Hat OpenStack Platform 17.1","status":"known_affected","remediations":[{"category":"workaround","details":"Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/openstack-redis@sha256:8096c9e75e718782eaf27f1c8375af14a13446245c2cc4ab9b5a59e4cf8f46fc?repository_url=registry.redhat.io/rhosp-rhel9/openstack-redis","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat Ansible Automation Platform 2.6:registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:105ae98f9f09b478e0187f6a02e364e075b7b7389ec0f423f60929f0e1ebf6a8_amd64","product":"registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:105ae98f9f09b478e0187f6a02e364e075b7b7389ec0f423f60929f0e1ebf6a8_amd64 as a component of Red Hat Ansible Automation Platform 2.6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/aap-must-gather-rhel9@sha256%3A105ae98f9f09b478e0187f6a02e364e075b7b7389ec0f423f60929f0e1ebf6a8?arch=amd64&repository_url=registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9&tag=1791938867","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat Ansible Automation Platform 2.6:registry.redhat.io/ansible-automation-platform-26/lightspeed-rhel9@sha256:82f4722e1870fa651fc86de51bf5cee77384d1c6df28f0d011dae3c599266f73_ppc64le","product":"registry.redhat.io/ansible-automation-platform-26/lightspeed-rhel9@sha256:82f4722e1870fa651fc86de51bf5cee77384d1c6df28f0d011dae3c599266f73_ppc64le as a component of Red Hat Ansible Automation Platform 2.6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/lightspeed-rhel9@sha256%3A82f4722e1870fa651fc86de51bf5cee77384d1c6df28f0d011dae3c599266f73?arch=ppc64le&repository_url=registry.redhat.io/ansible-automation-platform-26/lightspeed-rhel9&tag=1791898403","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-rhel9-operator@sha256:8cca3f06ea3f9d0e25048e196d6627d2688613955be4dd2c313b3acda4713505_amd64","product":"registry.redhat.io/ansible-automation-platform-27/lightspeed-rhel9-operator@sha256:8cca3f06ea3f9d0e25048e196d6627d2688613955be4dd2c313b3acda4713505_amd64 as a component of Red Hat Ansible Automation Platform 2.7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/lightspeed-rhel9-operator@sha256%3A8cca3f06ea3f9d0e25048e196d6627d2688613955be4dd2c313b3acda4713505?arch=amd64&repository_url=registry.redhat.io/ansible-automation-platform-27/lightspeed-rhel9-operator&tag=1792138238","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat OpenShift AI 2.25:registry.redhat.io/rhoai/odh-kueue-controller-rhel9@sha256:d6edef24c15ae414b8b34b8bd202a6abe7208e99f47bf7e4d64b6ac1e70c6f3d_ppc64le","product":"registry.redhat.io/rhoai/odh-kueue-controller-rhel9@sha256:d6edef24c15ae414b8b34b8bd202a6abe7208e99f47bf7e4d64b6ac1e70c6f3d_ppc64le as a component of Red Hat OpenShift AI 2.25","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-kueue-controller-rhel9@sha256%3Ad6edef24c15ae414b8b34b8bd202a6abe7208e99f47bf7e4d64b6ac1e70c6f3d?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-kueue-controller-rhel9&tag=1791854046","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat OpenShift AI 2.25:registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:65864c015c8e236b8805c0ec5ed635ee5915c2c9b9350dc227fa96a064fff85f_s390x","product":"registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:65864c015c8e236b8805c0ec5ed635ee5915c2c9b9350dc227fa96a064fff85f_s390x as a component of Red Hat OpenShift AI 2.25","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256%3A65864c015c8e236b8805c0ec5ed635ee5915c2c9b9350dc227fa96a064fff85f?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9&tag=1791393968","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-autorag-rhel9@sha256:e2052cdc42978bf2c18fedf1e5c16c5870a85d2f6b59fdbd739ea909c31afb6c_s390x","product":"registry.redhat.io/rhoai/odh-autorag-rhel9@sha256:e2052cdc42978bf2c18fedf1e5c16c5870a85d2f6b59fdbd739ea909c31afb6c_s390x as a component of Red Hat OpenShift AI 3.4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-autorag-rhel9@sha256%3Ae2052cdc42978bf2c18fedf1e5c16c5870a85d2f6b59fdbd739ea909c31afb6c?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-autorag-rhel9&tag=1791557539","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-llm-d-batch-gateway-apiserver-rhel9@sha256:a1283f6682e58a0a8ad2e06d200ea487217e597ae3d56ac0c821be77f297ca66_s390x","product":"registry.redhat.io/rhoai/odh-llm-d-batch-gateway-apiserver-rhel9@sha256:a1283f6682e58a0a8ad2e06d200ea487217e597ae3d56ac0c821be77f297ca66_s390x as a component of Red Hat OpenShift AI 3.4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-llm-d-batch-gateway-apiserver-rhel9@sha256%3Aa1283f6682e58a0a8ad2e06d200ea487217e597ae3d56ac0c821be77f297ca66?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-llm-d-batch-gateway-apiserver-rhel9&tag=1791510014","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-mod-arch-mlflow-rhel9@sha256:eaeec299cda37de214ba2a7a0437ac02407577c523122de77a2727531e980f8b_ppc64le","product":"registry.redhat.io/rhoai/odh-mod-arch-mlflow-rhel9@sha256:eaeec299cda37de214ba2a7a0437ac02407577c523122de77a2727531e980f8b_ppc64le as a component of Red Hat OpenShift AI 3.4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-mod-arch-mlflow-rhel9@sha256%3Aeaeec299cda37de214ba2a7a0437ac02407577c523122de77a2727531e980f8b?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-mod-arch-mlflow-rhel9&tag=1791861383","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-ta-lmes-job-rhel9@sha256:a6a0c57a602d5a62517c585e0a50daf93f942bbfe6af7f7a19d9e837919bbef2_amd64","product":"registry.redhat.io/rhoai/odh-ta-lmes-job-rhel9@sha256:a6a0c57a602d5a62517c585e0a50daf93f942bbfe6af7f7a19d9e837919bbef2_amd64 as a component of Red Hat OpenShift AI 3.4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-ta-lmes-job-rhel9@sha256%3Aa6a0c57a602d5a62517c585e0a50daf93f942bbfe6af7f7a19d9e837919bbef2?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-ta-lmes-job-rhel9&tag=1791470318","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]},{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json","productId":"red_hat_openshift_container_platform_4:python-tornado.src","product":"python-tornado.src as a component of Red Hat OpenShift Container Platform 4","status":"known_not_affected","remediations":[],"justification":"component_not_present","purl":"pkg:rpm/redhat/python-tornado@6.1.0-3.el9ocp.1?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-103262","modified":"2026-10-22T05:23:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103262.json"}]}],"vendorCoverage":{"total":793,"shown":32,"omitted":761,"source":"redhat"}}