{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74589", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.918Z", "datePublished": "2026-08-22T15:31:41.177Z", "dateUpdated": "2026-08-25T05:40:16.327Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:16.327Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix sk_redir use-after-free in send verdict\n\nsk_psock_msg_verdict() takes a socket reference for psock->sk_redir.\ntcp_bpf_send_verdict() copies that pointer while holding the source socket\nlock, but does not take a reference for the local copy before dropping the\nlock around tcp_bpf_sendmsg_redir().\n\nWhen apply_bytes keeps the cached verdict active, another sendmsg() on the\nsame source socket can consume the remaining bytes and release the cached\nreference while the first thread still holds only the raw local pointer:\n\n CPU 0 CPU 1\n sk_redir = psock->sk_redir\n apply_bytes remains nonzero\n release_sock(sk)\n lock_sock(sk)\n apply_bytes reaches zero\n psock->sk_redir = NULL\n release_sock(sk)\n tcp_bpf_sendmsg_redir(sk_redir)\n sock_put(sk_redir)\n tcp_bpf_sendmsg_redir(sk_redir)\n\nThe final sock_put() can free sk_redir before CPU 0 dereferences it.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020\n Read of size 8 at addr ffff888108537090 by task poc/87\n Call Trace:\n tcp_bpf_sendmsg_redir+0xf39/0x1020\n tcp_bpf_sendmsg+0x977/0x1a50\n __sys_sendto+0x32c/0x3a0\n __x64_sys_sendto+0xdb/0x1b0\n Allocated by task 85:\n sk_prot_alloc+0x56/0x210\n sk_clone+0x6f/0x14b0\n inet_csk_clone_lock+0x24/0x740\n tcp_create_openreq_child+0x25/0x2710\n tcp_v4_syn_recv_sock+0x10a/0xe00\n Freed by task 0:\n __kasan_slab_free+0x43/0x70\n slab_free_after_rcu_debug+0xa6/0x1e0\n rcu_core+0x50a/0x1850\n Last potentially related work creation:\n __sk_destruct+0x3da/0x540\n sk_psock_destroy+0x81e/0xab0\n process_one_work+0x63a/0x1070\n\nTake a temporary socket reference while the source socket lock still\nprotects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir()\nreturns. This keeps each unlocked use independent of cached-verdict\nownership."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is reached via local sendmsg/sendto on a TCP socket whose ->sendmsg was replaced by tcp_bpf_sendmsg() after BPF sockmap SK_MSG verdict attachment; per kernel CNA BPF/sockmap guidance this path is Local even when remote peers drive outbound traffic on internet-facing eBPF proxies.\nAC:L - The race needs two concurrent sendmsg() calls on the same sockmap-attached source socket while a cached __SK_REDIRECT verdict still has nonzero apply_bytes; the attacker controls both racing threads locally or can reliably create them on a multi-threaded server with concurrent client requests.\nPR:N - The highest-impact reasonable deployment is an internet-facing Cilium/service-mesh node with pre-installed sockmap SK_MSG redirect programs; an unauthenticated remote client can trigger concurrent outbound sends on enrolled sockets without any privileges on the victim host, while self-setup only raises the bar to CAP_NET_ADMIN in a user namespace.\nUI:N - Exploitation requires only network traffic to a vulnerable proxy or the attacker's own concurrent sendmsg threads; no victim user action such as mounting filesystems, opening files, or clicking links is needed.\nS:U - The slab use-after-free corrupts a struct sock in the host kernel security authority and enables standard kernel memory corruption or privilege escalation; it does not by itself cross VM, IOMMU, or container sandbox boundaries.\nC:H - KASAN reported slab-use-after-free in tcp_bpf_sendmsg_redir() with an 8-byte read through a freed struct sock; reclaiming that socket object enables attacker-controlled contents and arbitrary kernel memory disclosure via subsequent dereferences.\nI:H - Use-after-free on struct sock provides groomable heap control over sk_prot and callback pointers in tcp_bpf_sendmsg_redir(), yielding standard kernel UAF write primitives usable for arbitrary modification and privilege escalation.\nA:H - The published KASAN trace shows deterministic slab-use-after-free during send verdict redirect processing; UAF on struct sock can oops or panic the kernel during dereference even when full exploitation is not attempted."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_bpf.c"], "versions": [{"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "90a19b0894ba79a699b48cf44421b36fbd566e99", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "d192cff2a37d59206dabe6ec2e60ceac6271f274", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "1cec526cf0a2227395f2c2f4b671cb052ff0b00e", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "a76624733730e541e4955fdecf506af2f6b20558", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_bpf.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf"}, {"url": "https://git.kernel.org/stable/c/9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3"}, {"url": "https://git.kernel.org/stable/c/90a19b0894ba79a699b48cf44421b36fbd566e99"}, {"url": "https://git.kernel.org/stable/c/d192cff2a37d59206dabe6ec2e60ceac6271f274"}, {"url": "https://git.kernel.org/stable/c/4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf"}, {"url": "https://git.kernel.org/stable/c/a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10"}, {"url": "https://git.kernel.org/stable/c/1cec526cf0a2227395f2c2f4b671cb052ff0b00e"}, {"url": "https://git.kernel.org/stable/c/a76624733730e541e4955fdecf506af2f6b20558"}], "title": "bpf, sockmap: Fix sk_redir use-after-free in send verdict", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/tcp_bpf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "90a19b0894ba79a699b48cf44421b36fbd566e99", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "d192cff2a37d59206dabe6ec2e60ceac6271f274", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "1cec526cf0a2227395f2c2f4b671cb052ff0b00e", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "a76624733730e541e4955fdecf506af2f6b20558", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/tcp_bpf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix sk_redir use-after-free in send verdict\n\nsk_psock_msg_verdict() takes a socket reference for psock->sk_redir.\ntcp_bpf_send_verdict() copies that pointer while holding the source socket\nlock, but does not take a reference for the local copy before dropping the\nlock around tcp_bpf_sendmsg_redir().\n\nWhen apply_bytes keeps the cached verdict active, another sendmsg() on the\nsame source socket can consume the remaining bytes and release the cached\nreference while the first thread still holds only the raw local pointer:\n\n CPU 0 CPU 1\n sk_redir = psock->sk_redir\n apply_bytes remains nonzero\n release_sock(sk)\n lock_sock(sk)\n apply_bytes reaches zero\n psock->sk_redir = NULL\n release_sock(sk)\n tcp_bpf_sendmsg_redir(sk_redir)\n sock_put(sk_redir)\n tcp_bpf_sendmsg_redir(sk_redir)\n\nThe final sock_put() can free sk_redir before CPU 0 dereferences it.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020\n Read of size 8 at addr ffff888108537090 by task poc/87\n Call Trace:\n tcp_bpf_sendmsg_redir+0xf39/0x1020\n tcp_bpf_sendmsg+0x977/0x1a50\n __sys_sendto+0x32c/0x3a0\n __x64_sys_sendto+0xdb/0x1b0\n Allocated by task 85:\n sk_prot_alloc+0x56/0x210\n sk_clone+0x6f/0x14b0\n inet_csk_clone_lock+0x24/0x740\n tcp_create_openreq_child+0x25/0x2710\n tcp_v4_syn_recv_sock+0x10a/0xe00\n Freed by task 0:\n __kasan_slab_free+0x43/0x70\n slab_free_after_rcu_debug+0xa6/0x1e0\n rcu_core+0x50a/0x1850\n Last potentially related work creation:\n __sk_destruct+0x3da/0x540\n sk_psock_destroy+0x81e/0xab0\n process_one_work+0x63a/0x1070\n\nTake a temporary socket reference while the source socket lock still\nprotects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir()\nreturns. This keeps each unlocked use independent of cached-verdict\nownership."}], "id": "CVE-2026-74589", "lastModified": "2026-08-25T06:18:33.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:31.097", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1cec526cf0a2227395f2c2f4b671cb052ff0b00e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/90a19b0894ba79a699b48cf44421b36fbd566e99"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a76624733730e541e4955fdecf506af2f6b20558"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d192cff2a37d59206dabe6ec2e60ceac6271f274"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf, sockmap: Fix sk_redir use-after-free in send verdict", "id": "2521400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521400"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf, sockmap: Fix sk_redir use-after-free in send verdict\nsk_psock_msg_verdict() takes a socket reference for psock->sk_redir.\ntcp_bpf_send_verdict() copies that pointer while holding the source socket\nlock, but does not take a reference for the local copy before dropping the\nlock around tcp_bpf_sendmsg_redir().\nWhen apply_bytes keeps the cached verdict active, another sendmsg() on the\nsame source socket can consume the remaining bytes and release the cached\nreference while the first thread still holds only the raw local pointer:\nCPU 0 CPU 1\nsk_redir = psock->sk_redir\napply_bytes remains nonzero\nrelease_sock(sk)\nlock_sock(sk)\napply_bytes reaches zero\npsock->sk_redir = NULL\nrelease_sock(sk)\ntcp_bpf_sendmsg_redir(sk_redir)\nsock_put(sk_redir)\ntcp_bpf_sendmsg_redir(sk_redir)\nThe final sock_put() can free sk_redir before CPU 0 dereferences it.\nKASAN reported:\nBUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020\nRead of size 8 at addr ffff888108537090 by task poc/87\nCall Trace:\ntcp_bpf_sendmsg_redir+0xf39/0x1020\ntcp_bpf_sendmsg+0x977/0x1a50\n__sys_sendto+0x32c/0x3a0\n__x64_sys_sendto+0xdb/0x1b0\nAllocated by task 85:\nsk_prot_alloc+0x56/0x210\nsk_clone+0x6f/0x14b0\ninet_csk_clone_lock+0x24/0x740\ntcp_create_openreq_child+0x25/0x2710\ntcp_v4_syn_recv_sock+0x10a/0xe00\nFreed by task 0:\n__kasan_slab_free+0x43/0x70\nslab_free_after_rcu_debug+0xa6/0x1e0\nrcu_core+0x50a/0x1850\nLast potentially related work creation:\n__sk_destruct+0x3da/0x540\nsk_psock_destroy+0x81e/0xab0\nprocess_one_work+0x63a/0x1070\nTake a temporary socket reference while the source socket lock still\nprotects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir()\nreturns. This keeps each unlocked use independent of cached-verdict\nownership.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) sockmap feature. A use-after-free vulnerability exists in the sk_redir mechanism within the tcp_bpf_sendmsg_redir() function. This occurs when a socket reference is prematurely released while another thread still holds a raw pointer to it, leading to memory corruption. An attacker could potentially exploit this to cause a denial of service or other unspecified impacts."], "name": "CVE-2026-74589", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74589\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74589\nhttps://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74589-30de@gregkh/T"], "threat_severity": "Moderate"}