{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2026/cve-2026-66485-els_os-oraclelinux6els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-28T11:35:44Z",
      "generator": {
        "date": "2026-10-28T11:35:44Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-66485-ELS_OS-ORACLELINUX6ELS",
      "initial_release_date": "2026-08-10T11:17:00Z",
      "revision_history": [
        {
          "date": "2026-08-10T11:17:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-28T11:35:44Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-66485"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux 6",
                "product": {
                  "name": "Oracle Linux 6",
                  "product_id": "Oracle-Linux-6",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Oracle Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.i686",
                "product": {
                  "name": "cpio-0:2.10-13.el6.i686",
                  "product_id": "cpio-0:2.10-13.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/cpio@2.10-13.el6?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.x86_64",
                "product": {
                  "name": "cpio-0:2.10-13.el6.x86_64",
                  "product_id": "cpio-0:2.10-13.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/cpio@2.10-13.el6?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
                "product": {
                  "name": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
                  "product_id": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/cpio@2.10-13.el6.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
                "product": {
                  "name": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
                  "product_id": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/cpio@2.10-13.el6.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.tuxcare.els1.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.i686"
        },
        "product_reference": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.i686"
        },
        "product_reference": "cpio-0:2.10-13.el6.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.x86_64"
        },
        "product_reference": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.x86_64"
        },
        "product_reference": "cpio-0:2.10-13.el6.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-66485",
      "cwe": {
        "id": "CWE-789",
        "name": "Memory Allocation with Excessive Size Value"
      },
      "notes": [
        {
          "category": "description",
          "text": "GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.\n\nThis issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "Oracle-Linux-6:cpio-0:2.10-13.el6.i686",
          "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.i686",
          "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
          "Oracle-Linux-6:cpio-0:2.10-13.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-66485"
        },
        {
          "category": "external",
          "summary": "https://cert.pl/en/posts/2026/08/CVE-2026-66484",
          "url": "https://cert.pl/en/posts/2026/08/CVE-2026-66484"
        },
        {
          "category": "external",
          "summary": "https://git.savannah.gnu.org/cgit/cpio.git",
          "url": "https://git.savannah.gnu.org/cgit/cpio.git"
        }
      ],
      "release_date": "2026-08-10T11:17:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-25T11:11:08.377793Z",
          "details": "Low impact: this flaw only causes a stack overflow and crash in the cpio process during extraction of a malicious archive, with no confidentiality or integrity impact and no code execution or privilege escalation. Exploitation requires user interaction (a user must extract an attacker-supplied cpio file), and the effect is limited to a short‑lived command‑line utility rather than a network‑exposed, long‑running service. Given that the vulnerable path is exercised only during archive extraction and not during routine server operation, the practical risk to managed enterprise servers and VMs is minimal, so this can be safely deprioritized.",
          "product_ids": [
            "Oracle-Linux-6:cpio-0:2.10-13.el6.i686",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.i686",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.x86_64"
          ]
        }
      ]
    }
  ]
}