CVE & CISA-KEV Catalog

CVE-2026-39820

HIGH
7.5
CVSS v3
NVD

Description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

CWE-770Allocation of Resources Without Limits or ThrottlingCWE-606

How to fix

Remediation Available
butaneRocky
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
butaneRed Hat / RHEL
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
butane-debuginfoRed Hat / RHEL
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
butane-debuginfoRocky
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
butane-debugsourceRocky
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
butane-debugsourceRed Hat / RHEL
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
butane-redistributableRocky
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
butane-redistributableRed Hat / RHEL
Fixed in:0:0.23.0-5.rhaos4.18.el8RHSA-2026:57482
Fixed in:0:0.21.0-6.rhaos4.16.el8RHSA-2026:56852
conforma-cli-stackRocky
Fixed in:v1-4@amd64RHSA-2026:48771
Fixed in:v1-4@ppc64leRHSA-2026:49767
Fixed in:v1-4@arm64_darwinRHSA-2026:37276
Fixed in:v1-4@amd64_darwinRHSA-2026:48771
Fixed in:v1-4@arm64_darwinRHSA-2026:36797
Fixed in:v1-4@s390xRHSA-2026:36797
Fixed in:v1-4@amd64_windowsRHSA-2026:36797
Fixed in:v1-4@amd64_darwinRHSA-2026:50888
conforma-cli-stackRed Hat / RHEL
Fixed in:v1-4@arm64RHSA-2026:49767
Fixed in:v1-4@arm64_darwinRHSA-2026:49767
Fixed in:v1-4@amd64_darwinRHSA-2026:36797
Fixed in:v1-4@amd64RHSA-2026:50888
Fixed in:v1-4@amd64_windowsRHSA-2026:48771
Fixed in:v1-4@ppc64leRHSA-2026:37276
Fixed in:v1-4@amd64_darwinRHSA-2026:49767
Fixed in:v1-4@arm64_darwinRHSA-2026:50888
containernetworking-pluginsRed Hat / RHEL
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
containernetworking-pluginsRocky
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
containernetworking-plugins-debuginfoRocky
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
containernetworking-plugins-debuginfoRed Hat / RHEL
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
containernetworking-plugins-debugsourceRocky
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
containernetworking-plugins-debugsourceRed Hat / RHEL
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.16.el8RHSA-2026:56852
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
Fixed in:1:1.4.0-10.rhaos4.18.el8RHSA-2026:57482
cosign-cli-stackRocky
Fixed in:v1-4@amd64_windowsRHSA-2026:37276
Fixed in:v1-4@s390xRHSA-2026:36797
Fixed in:v1-4@s390xRHSA-2026:50888
Fixed in:v1-4@amd64_darwinRHSA-2026:37276
Fixed in:v1-4@arm64RHSA-2026:36797
Fixed in:v1-4@amd64_windowsRHSA-2026:36797
Fixed in:v1-4@amd64RHSA-2026:50888
Fixed in:v1-4@amd64_darwinRHSA-2026:36797
cosign-cli-stackRed Hat / RHEL
Fixed in:v1-4@amd64_darwinRHSA-2026:37276
Fixed in:v1-4@ppc64leRHSA-2026:49767
Fixed in:v1-4@arm64_darwinRHSA-2026:49767
Fixed in:v1-4@arm64RHSA-2026:37276
Fixed in:v1-4@ppc64leRHSA-2026:37276
Fixed in:v1-4@arm64RHSA-2026:50888
Fixed in:v1-4@arm64_darwinRHSA-2026:48771
Fixed in:v1-4@amd64RHSA-2026:48771
cri-oRed Hat / RHEL
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
cri-oRocky
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
cri-o-debuginfoRed Hat / RHEL
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
cri-o-debuginfoRocky
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
cri-o-debugsourceRed Hat / RHEL
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
cri-o-debugsourceRocky
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.29.13-12.rhaos4.16.git979a5e6.el8RHSA-2026:56852
Fixed in:0:1.31.13-12.rhaos4.18.git249255c.el8RHSA-2026:57482
cri-toolsRocky
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
cri-toolsRed Hat / RHEL
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
cri-tools-debuginfoRocky
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
cri-tools-debuginfoRed Hat / RHEL
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
cri-tools-debugsourceRocky
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
cri-tools-debugsourceRed Hat / RHEL
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.29.0-8.el8RHSA-2026:56852
Fixed in:0:1.31.1-7.el8RHSA-2026:57482
Fixed in:0:1.29.0-8.el8RHSA-2026:56852

This vulnerability affects an unusually large number of packages. The highest-confidence fixes are shown above; the full list is longer. Check the referenced advisories for complete coverage.

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityNone
IntegrityNone
AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploit Intelligence

0.78%probability of exploitation in 30 days
54thpercentile

Moderate risk: more likely to be exploited than 54% of all known CVEs.

References

Patch1
Vendor Advisory1

Related Vulnerabilities

Other CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2023-50387High7.5100%-Fix
CVE-2019-11478Medium5.395%-Fix
CVE-2019-11479High7.592%-Fix
CVE-2024-27316High7.591%-Fix
CVE-2022-30522High7.590%-Fix
CVE-2019-9515High7.587%-Fix

Common questions

How do I fix CVE-2026-39820?

Published advisories record a fix for 268 affected products. The "How to fix" section on this page lists the fixed version and source advisory for each one, so apply the entry matching what you actually run.

Is CVE-2026-39820 being actively exploited?

Not that we know of. CVE-2026-39820 is not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS score of 0.78% is the estimated probability that it will be exploited in the next 30 days. That is higher than 54% of all scored CVEs.

How severe is CVE-2026-39820?

CVE-2026-39820 has a CVSS v3 base score of 7.5, rated important. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.

What does CVE-2026-39820 affect?

Published advisories record a fix for butane (Rocky), butane (Red Hat / RHEL), butane-debuginfo (Red Hat / RHEL), butane-debuginfo (Rocky), and 264 more. The list on this page is capped, so there may be more.

Embed a live status badge for CVE-2026-39820
CVE-2026-39820 severity badge

Markdown

[![CVE-2026-39820](https://tridentstack.com/cve/badge/CVE-2026-39820.svg)](https://tridentstack.com/cve/CVE-2026-39820)

HTML

<a href="https://tridentstack.com/cve/CVE-2026-39820"><img src="https://tridentstack.com/cve/badge/CVE-2026-39820.svg" alt="CVE-2026-39820"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

See how it worksStart freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-08-28.