cve-2026-53422
MEDIUM CVSS 4.3 csaf_redhat
Description
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Timeline
- Published
- 2026-07-02 16:06 UTC
- Last Modified
- 2026-08-06
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
No references available.
Linked Vulnerabilities
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright © Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53422.json"
}
],
"title": "erlang: ssh: Erlang OTP ssh: Information disclosure via SFTP REALPATH handler",
"tracking": {
"current_release_date": "2026-08-06T21:57:19+00:00",
"generator": {
"date": "2026-08-06T21:57:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "CVE-2026-53422",
"initial_release_date": "2026-07-02T16:06:03.802000+00:00",
"revision_history": [
{
"date": "2026-07-02T16:06:03.802000+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-24T15:02:11+00:00",
"number": "2",
"summary": "Current version"
},
{
"date": "2026-08-06T21:57:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "red_hat_hardened_images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
},
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 16.2",
"product": {
"name": "Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:16.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform 16.2"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 17.1",
"product": {
"name": "Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:17.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform 17.1"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 18.0",
"product": {
"name": "Red Hat OpenStack Platform 18.0",
"product_id": "red_hat_openstack_platform_18.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:18.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform 18.0"
},
{
"category": "product_version",
"name": "openssh.src",
"product": {
"name": "openssh.src",
"product_id": "openssh.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssh@10.3p1-4.hum1?arch=src"
}
}
},
{
"category": "product_version",
"name": "erlang-inets",
"product": {
"name": "erlang-inets",
"product_id": "erlang-inets",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-inets"
}
}
},
{
"category": "product_version",
"name": "erlang-compiler",
"product": {
"name": "erlang-compiler",
"product_id": "erlang-compiler",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-compiler"
}
}
},
{
"category": "product_version",
"name": "erlang-kernel",
"product": {
"name": "erlang-kernel",
"product_id": "erlang-kernel",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-kernel"
}
}
},
{
"category": "product_version",
"name": "erlang-public_key",
"product": {
"name": "erlang-public_key",
"product_id": "erlang-public_key",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-public_key"
}
}
},
{
"category": "product_version",
"name": "erlang-xmerl",
"product": {
"name": "erlang-xmerl",
"product_id": "erlang-xmerl",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-xmerl"
}
}
},
{
"category": "product_version",
"name": "erlang-tools",
"product": {
"name": "erlang-tools",
"product_id": "erlang-tools",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-tools"
}
}
},
{
"category": "product_version",
"name": "erlang-ssl",
"product": {
"name": "erlang-ssl",
"product_id": "erlang-ssl",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-ssl"
}
}
},
{
"category": "product_version",
"name": "erlang.src",
"product": {
"name": "erlang.src",
"product_id": "erlang.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang?arch=src"
}
}
},
{
"category": "product_version",
"name": "erlang-asn1",
"product": {
"name": "erlang-asn1",
"product_id": "erlang-asn1",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-asn1"
}
}
},
{
"category": "product_version",
"name": "erlang-hipe",
"product": {
"name": "erlang-hipe",
"product_id": "erlang-hipe",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-hipe"
}
}
},
{
"category": "product_version",
"name": "erlang-snmp",
"product": {
"name": "erlang-snmp",
"product_id": "erlang-snmp",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-snmp"
}
}
},
{
"category": "product_version",
"name": "erlang-mnesia",
"product": {
"name": "erlang-mnesia",
"product_id": "erlang-mnesia",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-mnesia"
}
}
},
{
"category": "product_version",
"name": "erlang-crypto",
"product": {
"name": "erlang-crypto",
"product_id": "erlang-crypto",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-crypto"
}
}
},
{
"category": "product_version",
"name": "erlang-os_mon",
"product": {
"name": "erlang-os_mon",
"product_id": "erlang-os_mon",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-os_mon"
}
}
},
{
"category": "product_version",
"name": "erlang-sasl",
"product": {
"name": "erlang-sasl",
"product_id": "erlang-sasl",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-sasl"
}
}
},
{
"category": "product_version",
"name": "erlang-stdlib",
"product": {
"name": "erlang-stdlib",
"product_id": "erlang-stdlib",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-stdlib"
}
}
},
{
"category": "product_version",
"name": "erlang-eldap",
"product": {
"name": "erlang-eldap",
"product_id": "erlang-eldap",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-eldap"
}
}
},
{
"category": "product_version",
"name": "erlang-parsetools",
"product": {
"name": "erlang-parsetools",
"product_id": "erlang-parsetools",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-parsetools"
}
}
},
{
"category": "product_version",
"name": "erlang-erts",
"product": {
"name": "erlang-erts",
"product_id": "erlang-erts",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-erts"
}
}
},
{
"category": "product_version",
"name": "erlang-syntax_tools",
"product": {
"name": "erlang-syntax_tools",
"product_id": "erlang-syntax_tools",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-syntax_tools"
}
}
},
{
"category": "product_version",
"name": "erlang-runtime_tools",
"product": {
"name": "erlang-runtime_tools",
"product_id": "erlang-runtime_tools",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-runtime_tools"
}
}
},
{
"branches": [
{
"category": "product_version",
"name": "erlang27-main@aarch64",
"product": {
"name": "erlang27-main@aarch64",
"product_id": "erlang27-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang27@27.3.4.14-1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "erlang27-main@src",
"product": {
"name": "erlang27-main@src",
"product_id": "erlang27-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang27@27.3.4.14-1.hum1?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "erlang27-main@x86_64",
"product": {
"name": "erlang27-main@x86_64",
"product_id": "erlang27-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang27@27.3.4.14-1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang27-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:erlang27-main@aarch64"
},
"product_reference": "erlang27-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang27-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:erlang27-main@src"
},
"product_reference": "erlang27-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang27-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:erlang27-main@x86_64"
},
"product_reference": "erlang27-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssh.src as a component of Red Hat Hardened Images",
"product_id": "red_hat_hardened_images:openssh.src"
},
"product_reference": "openssh.src",
"relates_to_product_reference": "red_hat_hardened_images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-asn1 as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-asn1"
},
"product_reference": "erlang-asn1",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-compiler as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-compiler"
},
"product_reference": "erlang-compiler",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-crypto as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-crypto"
},
"product_reference": "erlang-crypto",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-eldap as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-eldap"
},
"product_reference": "erlang-eldap",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-erts as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-erts"
},
"product_reference": "erlang-erts",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-hipe as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-hipe"
},
"product_reference": "erlang-hipe",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-inets as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-inets"
},
"product_reference": "erlang-inets",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-kernel as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-kernel"
},
"product_reference": "erlang-kernel",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-mnesia as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-mnesia"
},
"product_reference": "erlang-mnesia",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-os_mon as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-os_mon"
},
"product_reference": "erlang-os_mon",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-parsetools as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-parsetools"
},
"product_reference": "erlang-parsetools",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-public_key as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-public_key"
},
"product_reference": "erlang-public_key",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-runtime_tools as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-runtime_tools"
},
"product_reference": "erlang-runtime_tools",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-sasl as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-sasl"
},
"product_reference": "erlang-sasl",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-snmp as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-snmp"
},
"product_reference": "erlang-snmp",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-ssl as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-ssl"
},
"product_reference": "erlang-ssl",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-stdlib as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-stdlib"
},
"product_reference": "erlang-stdlib",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-syntax_tools as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-syntax_tools"
},
"product_reference": "erlang-syntax_tools",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-tools as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-tools"
},
"product_reference": "erlang-tools",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-xmerl as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang-xmerl"
},
"product_reference": "erlang-xmerl",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang.src as a component of Red Hat OpenStack Platform 16.2",
"product_id": "red_hat_openstack_platform_16.2:erlang.src"
},
"product_reference": "erlang.src",
"relates_to_product_reference": "red_hat_openstack_platform_16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-asn1 as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-asn1"
},
"product_reference": "erlang-asn1",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-compiler as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-compiler"
},
"product_reference": "erlang-compiler",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-crypto as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-crypto"
},
"product_reference": "erlang-crypto",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-eldap as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-eldap"
},
"product_reference": "erlang-eldap",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-erts as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-erts"
},
"product_reference": "erlang-erts",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-inets as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-inets"
},
"product_reference": "erlang-inets",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-kernel as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-kernel"
},
"product_reference": "erlang-kernel",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-mnesia as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-mnesia"
},
"product_reference": "erlang-mnesia",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-os_mon as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-os_mon"
},
"product_reference": "erlang-os_mon",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-parsetools as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-parsetools"
},
"product_reference": "erlang-parsetools",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-public_key as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-public_key"
},
"product_reference": "erlang-public_key",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-runtime_tools as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-runtime_tools"
},
"product_reference": "erlang-runtime_tools",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-sasl as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-sasl"
},
"product_reference": "erlang-sasl",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-snmp as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-snmp"
},
"product_reference": "erlang-snmp",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-ssl as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-ssl"
},
"product_reference": "erlang-ssl",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-stdlib as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-stdlib"
},
"product_reference": "erlang-stdlib",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-syntax_tools as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-syntax_tools"
},
"product_reference": "erlang-syntax_tools",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-tools as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-tools"
},
"product_reference": "erlang-tools",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-xmerl as a component of Red Hat OpenStack Platform 17.1",
"product_id": "red_hat_openstack_platform_17.1:erlang-xmerl"
},
"product_reference": "erlang-xmerl",
"relates_to_product_reference": "red_hat_openstack_platform_17.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang.src as a component of Red Hat OpenStack Platform 18.0",
"product_id": "red_hat_openstack_platform_18.0:erlang.src"
},
"product_reference": "erlang.src",
"relates_to_product_reference": "red_hat_openstack_platform_18.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-53422",
"cwe": {
"id": "CWE-204",
"name": "Observable Response Discrepancy"
},
"discovery_date": "2026-07-02T17:01:40.309805+00:00",
"flags": [
{
"label": "component_not_present",
"product_ids": [
"red_hat_hardened_images:openssh.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496622"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Erlang OTP's Secure Shell (SSH) component, specifically within the SSH File Transfer Protocol (SFTP) daemon's ssh_sftpd module. An authenticated SFTP user can exploit an observable response discrepancy in the REALPATH handler to enumerate the existence of files and directories outside their authorized root directory. This vulnerability allows an attacker to determine if specific paths exist on the server's file system, potentially revealing sensitive information about the system's structure. While this issue does not directly expose file contents or grant write access, the gathered information could be used to facilitate further attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "erlang: ssh: Erlang OTP ssh: Information disclosure via SFTP REALPATH handler",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:erlang27-main@aarch64",
"Red Hat Hardened Images:erlang27-main@src",
"Red Hat Hardened Images:erlang27-main@x86_64"
],
"known_affected": [
"red_hat_openstack_platform_16.2:erlang-asn1",
"red_hat_openstack_platform_16.2:erlang-compiler",
"red_hat_openstack_platform_16.2:erlang-crypto",
"red_hat_openstack_platform_16.2:erlang-eldap",
"red_hat_openstack_platform_16.2:erlang-erts",
"red_hat_openstack_platform_16.2:erlang-hipe",
"red_hat_openstack_platform_16.2:erlang-inets",
"red_hat_openstack_platform_16.2:erlang-kernel",
"red_hat_openstack_platform_16.2:erlang-mnesia",
"red_hat_openstack_platform_16.2:erlang-os_mon",
"red_hat_openstack_platform_16.2:erlang-parsetools",
"red_hat_openstack_platform_16.2:erlang-public_key",
"red_hat_openstack_platform_16.2:erlang-runtime_tools",
"red_hat_openstack_platform_16.2:erlang-sasl",
"red_hat_openstack_platform_16.2:erlang-snmp",
"red_hat_openstack_platform_16.2:erlang-ssl",
"red_hat_openstack_platform_16.2:erlang-stdlib",
"red_hat_openstack_platform_16.2:erlang-syntax_tools",
"red_hat_openstack_platform_16.2:erlang-tools",
"red_hat_openstack_platform_16.2:erlang-xmerl",
"red_hat_openstack_platform_16.2:erlang.src",
"red_hat_openstack_platform_17.1:erlang-asn1",
"red_hat_openstack_platform_17.1:erlang-compiler",
"red_hat_openstack_platform_17.1:erlang-crypto",
"red_hat_openstack_platform_17.1:erlang-eldap",
"red_hat_openstack_platform_17.1:erlang-erts",
"red_hat_openstack_platform_17.1:erlang-inets",
"red_hat_openstack_platform_17.1:erlang-kernel",
"red_hat_openstack_platform_17.1:erlang-mnesia",
"red_hat_openstack_platform_17.1:erlang-os_mon",
"red_hat_openstack_platform_17.1:erlang-parsetools",
"red_hat_openstack_platform_17.1:erlang-public_key",
"red_hat_openstack_platform_17.1:erlang-runtime_tools",
"red_hat_openstack_platform_17.1:erlang-sasl",
"red_hat_openstack_platform_17.1:erlang-snmp",
"red_hat_openstack_platform_17.1:erlang-ssl",
"red_hat_openstack_platform_17.1:erlang-stdlib",
"red_hat_openstack_platform_17.1:erlang-syntax_tools",
"red_hat_openstack_platform_17.1:erlang-tools",
"red_hat_openstack_platform_17.1:erlang-xmerl",
"red_hat_openstack_platform_18.0:erlang.src"
],
"known_not_affected": [
"red_hat_hardened_images:openssh.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53422"
},
{
"category": "external",
"summary": "RHBZ#2496622",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496622"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53422"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53422",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53422"
},
{
"category": "external",
"summary": "https://cna.erlef.org/cves/CVE-2026-53422.html",
"url": "https://cna.erlef.org/cves/CVE-2026-53422.html"
},
{
"category": "external",
"summary": "https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172",
"url": "https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172"
},
{
"category": "external",
"summary": "https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94",
"url": "https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94"
},
{
"category": "external",
"summary": "https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a",
"url": "https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a"
},
{
"category": "external",
"summary": "https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976",
"url": "https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976"
},
{
"category": "external",
"summary": "https://osv.dev/vulnerability/EEF-CVE-2026-53422",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-53422"
},
{
"category": "external",
"summary": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
}
],
"release_date": "2026-07-02T16:06:03.802000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-06T15:28:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:erlang27-main@aarch64",
"Red Hat Hardened Images:erlang27-main@src",
"Red Hat Hardened Images:erlang27-main@x86_64"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35998"
},
{
"category": "none_available",
"details": "Fix deferred",
"product_ids": [
"red_hat_openstack_platform_16.2:erlang-asn1",
"red_hat_openstack_platform_16.2:erlang-compiler",
"red_hat_openstack_platform_16.2:erlang-crypto",
"red_hat_openstack_platform_16.2:erlang-eldap",
"red_hat_openstack_platform_16.2:erlang-erts",
"red_hat_openstack_platform_16.2:erlang-hipe",
"red_hat_openstack_platform_16.2:erlang-inets",
"red_hat_openstack_platform_16.2:erlang-kernel",
"red_hat_openstack_platform_16.2:erlang-mnesia",
"red_hat_openstack_platform_16.2:erlang-os_mon",
"red_hat_openstack_platform_16.2:erlang-parsetools",
"red_hat_openstack_platform_16.2:erlang-public_key",
"red_hat_openstack_platform_16.2:erlang-runtime_tools",
"red_hat_openstack_platform_16.2:erlang-sasl",
"red_hat_openstack_platform_16.2:erlang-snmp",
"red_hat_openstack_platform_16.2:erlang-ssl",
"red_hat_openstack_platform_16.2:erlang-stdlib",
"red_hat_openstack_platform_16.2:erlang-syntax_tools",
"red_hat_openstack_platform_16.2:erlang-tools",
"red_hat_openstack_platform_16.2:erlang-xmerl",
"red_hat_openstack_platform_16.2:erlang.src",
"red_hat_openstack_platform_17.1:erlang-asn1",
"red_hat_openstack_platform_17.1:erlang-compiler",
"red_hat_openstack_platform_17.1:erlang-crypto",
"red_hat_openstack_platform_17.1:erlang-eldap",
"red_hat_openstack_platform_17.1:erlang-erts",
"red_hat_openstack_platform_17.1:erlang-inets",
"red_hat_openstack_platform_17.1:erlang-kernel",
"red_hat_openstack_platform_17.1:erlang-mnesia",
"red_hat_openstack_platform_17.1:erlang-os_mon",
"red_hat_openstack_platform_17.1:erlang-parsetools",
"red_hat_openstack_platform_17.1:erlang-public_key",
"red_hat_openstack_platform_17.1:erlang-runtime_tools",
"red_hat_openstack_platform_17.1:erlang-sasl",
"red_hat_openstack_platform_17.1:erlang-snmp",
"red_hat_openstack_platform_17.1:erlang-ssl",
"red_hat_openstack_platform_17.1:erlang-stdlib",
"red_hat_openstack_platform_17.1:erlang-syntax_tools",
"red_hat_openstack_platform_17.1:erlang-tools",
"red_hat_openstack_platform_17.1:erlang-xmerl",
"red_hat_openstack_platform_18.0:erlang.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:erlang27-main@aarch64",
"Red Hat Hardened Images:erlang27-main@src",
"Red Hat Hardened Images:erlang27-main@x86_64",
"red_hat_hardened_images:openssh.src",
"red_hat_openstack_platform_16.2:erlang-asn1",
"red_hat_openstack_platform_16.2:erlang-compiler",
"red_hat_openstack_platform_16.2:erlang-crypto",
"red_hat_openstack_platform_16.2:erlang-eldap",
"red_hat_openstack_platform_16.2:erlang-erts",
"red_hat_openstack_platform_16.2:erlang-hipe",
"red_hat_openstack_platform_16.2:erlang-inets",
"red_hat_openstack_platform_16.2:erlang-kernel",
"red_hat_openstack_platform_16.2:erlang-mnesia",
"red_hat_openstack_platform_16.2:erlang-os_mon",
"red_hat_openstack_platform_16.2:erlang-parsetools",
"red_hat_openstack_platform_16.2:erlang-public_key",
"red_hat_openstack_platform_16.2:erlang-runtime_tools",
"red_hat_openstack_platform_16.2:erlang-sasl",
"red_hat_openstack_platform_16.2:erlang-snmp",
"red_hat_openstack_platform_16.2:erlang-ssl",
"red_hat_openstack_platform_16.2:erlang-stdlib",
"red_hat_openstack_platform_16.2:erlang-syntax_tools",
"red_hat_openstack_platform_16.2:erlang-tools",
"red_hat_openstack_platform_16.2:erlang-xmerl",
"red_hat_openstack_platform_16.2:erlang.src",
"red_hat_openstack_platform_17.1:erlang-asn1",
"red_hat_openstack_platform_17.1:erlang-compiler",
"red_hat_openstack_platform_17.1:erlang-crypto",
"red_hat_openstack_platform_17.1:erlang-eldap",
"red_hat_openstack_platform_17.1:erlang-erts",
"red_hat_openstack_platform_17.1:erlang-inets",
"red_hat_openstack_platform_17.1:erlang-kernel",
"red_hat_openstack_platform_17.1:erlang-mnesia",
"red_hat_openstack_platform_17.1:erlang-os_mon",
"red_hat_openstack_platform_17.1:erlang-parsetools",
"red_hat_openstack_platform_17.1:erlang-public_key",
"red_hat_openstack_platform_17.1:erlang-runtime_tools",
"red_hat_openstack_platform_17.1:erlang-sasl",
"red_hat_openstack_platform_17.1:erlang-snmp",
"red_hat_openstack_platform_17.1:erlang-ssl",
"red_hat_openstack_platform_17.1:erlang-stdlib",
"red_hat_openstack_platform_17.1:erlang-syntax_tools",
"red_hat_openstack_platform_17.1:erlang-tools",
"red_hat_openstack_platform_17.1:erlang-xmerl",
"red_hat_openstack_platform_18.0:erlang.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate",
"product_ids": [
"Red Hat Hardened Images:erlang27-main@aarch64",
"Red Hat Hardened Images:erlang27-main@src",
"Red Hat Hardened Images:erlang27-main@x86_64",
"red_hat_hardened_images:openssh.src",
"red_hat_openstack_platform_16.2:erlang-asn1",
"red_hat_openstack_platform_16.2:erlang-compiler",
"red_hat_openstack_platform_16.2:erlang-crypto",
"red_hat_openstack_platform_16.2:erlang-eldap",
"red_hat_openstack_platform_16.2:erlang-erts",
"red_hat_openstack_platform_16.2:erlang-hipe",
"red_hat_openstack_platform_16.2:erlang-inets",
"red_hat_openstack_platform_16.2:erlang-kernel",
"red_hat_openstack_platform_16.2:erlang-mnesia",
"red_hat_openstack_platform_16.2:erlang-os_mon",
"red_hat_openstack_platform_16.2:erlang-parsetools",
"red_hat_openstack_platform_16.2:erlang-public_key",
"red_hat_openstack_platform_16.2:erlang-runtime_tools",
"red_hat_openstack_platform_16.2:erlang-sasl",
"red_hat_openstack_platform_16.2:erlang-snmp",
"red_hat_openstack_platform_16.2:erlang-ssl",
"red_hat_openstack_platform_16.2:erlang-stdlib",
"red_hat_openstack_platform_16.2:erlang-syntax_tools",
"red_hat_openstack_platform_16.2:erlang-tools",
"red_hat_openstack_platform_16.2:erlang-xmerl",
"red_hat_openstack_platform_16.2:erlang.src",
"red_hat_openstack_platform_17.1:erlang-asn1",
"red_hat_openstack_platform_17.1:erlang-compiler",
"red_hat_openstack_platform_17.1:erlang-crypto",
"red_hat_openstack_platform_17.1:erlang-eldap",
"red_hat_openstack_platform_17.1:erlang-erts",
"red_hat_openstack_platform_17.1:erlang-inets",
"red_hat_openstack_platform_17.1:erlang-kernel",
"red_hat_openstack_platform_17.1:erlang-mnesia",
"red_hat_openstack_platform_17.1:erlang-os_mon",
"red_hat_openstack_platform_17.1:erlang-parsetools",
"red_hat_openstack_platform_17.1:erlang-public_key",
"red_hat_openstack_platform_17.1:erlang-runtime_tools",
"red_hat_openstack_platform_17.1:erlang-sasl",
"red_hat_openstack_platform_17.1:erlang-snmp",
"red_hat_openstack_platform_17.1:erlang-ssl",
"red_hat_openstack_platform_17.1:erlang-stdlib",
"red_hat_openstack_platform_17.1:erlang-syntax_tools",
"red_hat_openstack_platform_17.1:erlang-tools",
"red_hat_openstack_platform_17.1:erlang-xmerl",
"red_hat_openstack_platform_18.0:erlang.src"
]
}
],
"title": "erlang: ssh: Erlang OTP ssh: Information disclosure via SFTP REALPATH handler"
}
]
}