{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "does not ensure that attribute parsing has linear time complexity relative to the size of the input",
    "tracking": {
      "current_release_date": "2026-08-14T04:40:09+00:00",
      "generator": {
        "date": "2026-08-14T04:40:09+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.3.0"
        }
      },
      "id": "CVE-2021-33587",
      "initial_release_date": "2021-05-28T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-08-14T04:40:09+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.19",
            "product": {
              "name": "OpenShift Container Platform 4.19",
              "product_id": "openshift-4",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Service Mesh OSSM 2.0.0",
            "product": {
              "name": "OpenShift Service Mesh OSSM 2.0.0",
              "product_id": "ossm-2.0",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:service_mesh:2.0"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
            "product": {
              "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
              "product_id": "rhacm-2",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:acm:2"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Virtualization 4.4.0",
            "product": {
              "name": "Red Hat Enterprise Virtualization 4.4.0",
              "product_id": "rhev-m-4",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:rhev_manager:4"
              }
            }
          },
          {
            "category": "product_version",
            "name": "openshift4/ose-grafana",
            "product": {
              "name": "openshift4/ose-grafana",
              "product_id": "openshift4/ose-grafana",
              "product_identification_helper": {
                "purl": "pkg:oci/ose-grafana?repository_url=registry.redhat.io/openshift4/ose-grafana"
              }
            }
          },
          {
            "category": "product_version",
            "name": "openshift4/ose-prometheus",
            "product": {
              "name": "openshift4/ose-prometheus",
              "product_id": "openshift4/ose-prometheus",
              "product_identification_helper": {
                "purl": "pkg:oci/ose-prometheus?repository_url=registry.redhat.io/openshift4/ose-prometheus"
              }
            }
          },
          {
            "category": "product_version",
            "name": "openshift4/ose-thanos-rhel8",
            "product": {
              "name": "openshift4/ose-thanos-rhel8",
              "product_id": "openshift4/ose-thanos-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/ose-thanos-rhel8?repository_url=registry.redhat.io/openshift4/ose-thanos-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ovirt-engine-ui-extensions",
            "product": {
              "name": "ovirt-engine-ui-extensions",
              "product_id": "ovirt-engine-ui-extensions.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/ovirt-engine-ui-extensions?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ovirt-web-ui",
            "product": {
              "name": "ovirt-web-ui",
              "product_id": "ovirt-web-ui",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/ovirt-web-ui"
              }
            }
          },
          {
            "category": "product_version",
            "name": "ovirt-web-ui",
            "product": {
              "name": "ovirt-web-ui",
              "product_id": "ovirt-web-ui.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/ovirt-web-ui?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/application-ui-rhel8",
            "product": {
              "name": "rhacm2/application-ui-rhel8",
              "product_id": "rhacm2/application-ui-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/application-ui-rhel8?repository_url=registry.redhat.io/rhacm2/application-ui-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/console-header-rhel8",
            "product": {
              "name": "rhacm2/console-header-rhel8",
              "product_id": "rhacm2/console-header-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/console-header-rhel8?repository_url=registry.redhat.io/rhacm2/console-header-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/console-rhel8",
            "product": {
              "name": "rhacm2/console-rhel8",
              "product_id": "rhacm2/console-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/console-rhel8?repository_url=registry.redhat.io/rhacm2/console-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/console-ui-rhel8",
            "product": {
              "name": "rhacm2/console-ui-rhel8",
              "product_id": "rhacm2/console-ui-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/console-ui-rhel8?repository_url=registry.redhat.io/rhacm2/console-ui-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/grc-ui-rhel8",
            "product": {
              "name": "rhacm2/grc-ui-rhel8",
              "product_id": "rhacm2/grc-ui-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/grc-ui-rhel8?repository_url=registry.redhat.io/rhacm2/grc-ui-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/kui-web-terminal-rhel8",
            "product": {
              "name": "rhacm2/kui-web-terminal-rhel8",
              "product_id": "rhacm2/kui-web-terminal-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/kui-web-terminal-rhel8?repository_url=registry.redhat.io/rhacm2/kui-web-terminal-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/mcm-topology-rhel8",
            "product": {
              "name": "rhacm2/mcm-topology-rhel8",
              "product_id": "rhacm2/mcm-topology-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/mcm-topology-rhel8?repository_url=registry.redhat.io/rhacm2/mcm-topology-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/search-ui-rhel8",
            "product": {
              "name": "rhacm2/search-ui-rhel8",
              "product_id": "rhacm2/search-ui-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/search-ui-rhel8?repository_url=registry.redhat.io/rhacm2/search-ui-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "servicemesh-grafana",
            "product": {
              "name": "servicemesh-grafana",
              "product_id": "servicemesh-grafana",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/servicemesh-grafana"
              }
            }
          },
          {
            "category": "product_version",
            "name": "servicemesh-grafana-prometheus",
            "product": {
              "name": "servicemesh-grafana-prometheus",
              "product_id": "servicemesh-grafana-prometheus",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/servicemesh-grafana-prometheus"
              }
            }
          },
          {
            "category": "product_version",
            "name": "servicemesh-grafana",
            "product": {
              "name": "servicemesh-grafana",
              "product_id": "servicemesh-grafana.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/servicemesh-grafana?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "servicemesh-prometheus",
            "product": {
              "name": "servicemesh-prometheus",
              "product_id": "servicemesh-prometheus",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/servicemesh-prometheus"
              }
            }
          },
          {
            "category": "product_version",
            "name": "servicemesh-prometheus",
            "product": {
              "name": "servicemesh-prometheus",
              "product_id": "servicemesh-prometheus.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/servicemesh-prometheus?arch=src"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-grafana as a component of OpenShift Container Platform 4.19",
          "product_id": "openshift-4:openshift4/ose-grafana"
        },
        "product_reference": "openshift4/ose-grafana",
        "relates_to_product_reference": "openshift-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-prometheus as a component of OpenShift Container Platform 4.19",
          "product_id": "openshift-4:openshift4/ose-prometheus"
        },
        "product_reference": "openshift4/ose-prometheus",
        "relates_to_product_reference": "openshift-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-thanos-rhel8 as a component of OpenShift Container Platform 4.19",
          "product_id": "openshift-4:openshift4/ose-thanos-rhel8"
        },
        "product_reference": "openshift4/ose-thanos-rhel8",
        "relates_to_product_reference": "openshift-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-ui-extensions.src as a component of Red Hat Enterprise Virtualization 4.4.0",
          "product_id": "rhev-m-4:ovirt-engine-ui-extensions.src"
        },
        "product_reference": "ovirt-engine-ui-extensions.src",
        "relates_to_product_reference": "rhev-m-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-web-ui as a component of Red Hat Enterprise Virtualization 4.4.0",
          "product_id": "rhev-m-4:ovirt-web-ui"
        },
        "product_reference": "ovirt-web-ui",
        "relates_to_product_reference": "rhev-m-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-web-ui.src as a component of Red Hat Enterprise Virtualization 4.4.0",
          "product_id": "rhev-m-4:ovirt-web-ui.src"
        },
        "product_reference": "ovirt-web-ui.src",
        "relates_to_product_reference": "rhev-m-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/application-ui-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/application-ui-rhel8"
        },
        "product_reference": "rhacm2/application-ui-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/console-header-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/console-header-rhel8"
        },
        "product_reference": "rhacm2/console-header-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/console-rhel8"
        },
        "product_reference": "rhacm2/console-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/console-ui-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/console-ui-rhel8"
        },
        "product_reference": "rhacm2/console-ui-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/grc-ui-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/grc-ui-rhel8"
        },
        "product_reference": "rhacm2/grc-ui-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/kui-web-terminal-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/kui-web-terminal-rhel8"
        },
        "product_reference": "rhacm2/kui-web-terminal-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/mcm-topology-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/mcm-topology-rhel8"
        },
        "product_reference": "rhacm2/mcm-topology-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/search-ui-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/search-ui-rhel8"
        },
        "product_reference": "rhacm2/search-ui-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-grafana as a component of OpenShift Service Mesh OSSM 2.0.0",
          "product_id": "ossm-2.0:servicemesh-grafana"
        },
        "product_reference": "servicemesh-grafana",
        "relates_to_product_reference": "ossm-2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-grafana-prometheus as a component of OpenShift Service Mesh OSSM 2.0.0",
          "product_id": "ossm-2.0:servicemesh-grafana-prometheus"
        },
        "product_reference": "servicemesh-grafana-prometheus",
        "relates_to_product_reference": "ossm-2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-grafana.src as a component of OpenShift Service Mesh OSSM 2.0.0",
          "product_id": "ossm-2.0:servicemesh-grafana.src"
        },
        "product_reference": "servicemesh-grafana.src",
        "relates_to_product_reference": "ossm-2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus as a component of OpenShift Service Mesh OSSM 2.0.0",
          "product_id": "ossm-2.0:servicemesh-prometheus"
        },
        "product_reference": "servicemesh-prometheus",
        "relates_to_product_reference": "ossm-2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus.src as a component of OpenShift Service Mesh OSSM 2.0.0",
          "product_id": "ossm-2.0:servicemesh-prometheus.src"
        },
        "product_reference": "servicemesh-prometheus.src",
        "relates_to_product_reference": "ossm-2.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-33587",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-05-31T00:00:00+00:00",
      "notes": [
        {
          "category": "other",
          "text": "In the OpenShift ServiceMesh (OSSM) , Red Hat OpenShift Container Platform (RHOCP), and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs css-what library to authenticated users only, therefore the impact is low.\n\nIn Red Hat Virtualization css-what is not a production dependency. An update may be provided in a future release.",
          "title": "Statement"
        },
        {
          "category": "description",
          "text": "A flaw was found in nodejs-css-what. The css-what package for Node.js does not ensure that attribute parsing has a Linear Time Complexity relative to the size of the input. The highest threat from this vulnerability is to system availability.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "openshift-4:openshift4/ose-grafana",
          "openshift-4:openshift4/ose-prometheus",
          "openshift-4:openshift4/ose-thanos-rhel8",
          "ossm-2.0:servicemesh-grafana",
          "ossm-2.0:servicemesh-grafana-prometheus",
          "ossm-2.0:servicemesh-grafana.src",
          "ossm-2.0:servicemesh-prometheus",
          "ossm-2.0:servicemesh-prometheus.src",
          "rhacm-2:rhacm2/application-ui-rhel8",
          "rhacm-2:rhacm2/console-header-rhel8",
          "rhacm-2:rhacm2/console-rhel8",
          "rhacm-2:rhacm2/console-ui-rhel8",
          "rhacm-2:rhacm2/grc-ui-rhel8",
          "rhacm-2:rhacm2/kui-web-terminal-rhel8",
          "rhacm-2:rhacm2/mcm-topology-rhel8",
          "rhacm-2:rhacm2/search-ui-rhel8",
          "rhev-m-4:ovirt-engine-ui-extensions.src",
          "rhev-m-4:ovirt-web-ui",
          "rhev-m-4:ovirt-web-ui.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-33587"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33587"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-33587"
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Will not fix",
          "product_ids": [
            "openshift-4:openshift4/ose-grafana",
            "openshift-4:openshift4/ose-prometheus",
            "openshift-4:openshift4/ose-thanos-rhel8",
            "rhacm-2:rhacm2/application-ui-rhel8",
            "rhacm-2:rhacm2/console-header-rhel8",
            "rhacm-2:rhacm2/console-rhel8",
            "rhacm-2:rhacm2/console-ui-rhel8",
            "rhacm-2:rhacm2/grc-ui-rhel8",
            "rhacm-2:rhacm2/kui-web-terminal-rhel8",
            "rhacm-2:rhacm2/mcm-topology-rhel8",
            "rhacm-2:rhacm2/search-ui-rhel8",
            "rhev-m-4:ovirt-engine-ui-extensions.src",
            "rhev-m-4:ovirt-web-ui",
            "rhev-m-4:ovirt-web-ui.src"
          ]
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "ossm-2.0:servicemesh-grafana",
            "ossm-2.0:servicemesh-grafana-prometheus",
            "ossm-2.0:servicemesh-grafana.src",
            "ossm-2.0:servicemesh-prometheus",
            "ossm-2.0:servicemesh-prometheus.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "baseScore": 7.5,
            "baseSeverity": "HIGH"
          },
          "products": [
            "openshift-4:openshift4/ose-grafana",
            "openshift-4:openshift4/ose-prometheus",
            "openshift-4:openshift4/ose-thanos-rhel8",
            "ossm-2.0:servicemesh-grafana",
            "ossm-2.0:servicemesh-grafana-prometheus",
            "ossm-2.0:servicemesh-grafana.src",
            "ossm-2.0:servicemesh-prometheus",
            "ossm-2.0:servicemesh-prometheus.src",
            "rhacm-2:rhacm2/application-ui-rhel8",
            "rhacm-2:rhacm2/console-header-rhel8",
            "rhacm-2:rhacm2/console-rhel8",
            "rhacm-2:rhacm2/console-ui-rhel8",
            "rhacm-2:rhacm2/grc-ui-rhel8",
            "rhacm-2:rhacm2/kui-web-terminal-rhel8",
            "rhacm-2:rhacm2/mcm-topology-rhel8",
            "rhacm-2:rhacm2/search-ui-rhel8",
            "rhev-m-4:ovirt-engine-ui-extensions.src",
            "rhev-m-4:ovirt-web-ui",
            "rhev-m-4:ovirt-web-ui.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low",
          "product_ids": [
            "openshift-4:openshift4/ose-grafana",
            "openshift-4:openshift4/ose-prometheus",
            "openshift-4:openshift4/ose-thanos-rhel8",
            "rhacm-2:rhacm2/application-ui-rhel8",
            "rhacm-2:rhacm2/console-header-rhel8",
            "rhacm-2:rhacm2/console-rhel8",
            "rhacm-2:rhacm2/console-ui-rhel8",
            "rhacm-2:rhacm2/grc-ui-rhel8",
            "rhacm-2:rhacm2/kui-web-terminal-rhel8",
            "rhacm-2:rhacm2/mcm-topology-rhel8",
            "rhacm-2:rhacm2/search-ui-rhel8",
            "rhev-m-4:ovirt-engine-ui-extensions.src",
            "rhev-m-4:ovirt-web-ui",
            "rhev-m-4:ovirt-web-ui.src"
          ]
        },
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "ossm-2.0:servicemesh-grafana",
            "ossm-2.0:servicemesh-grafana-prometheus",
            "ossm-2.0:servicemesh-grafana.src",
            "ossm-2.0:servicemesh-prometheus",
            "ossm-2.0:servicemesh-prometheus.src"
          ]
        }
      ],
      "title": "does not ensure that attribute parsing has linear time complexity relative to the size of the input"
    }
  ]
}