Since approx 2026-01-09 10:00UTC we're seeing the rhel-vex updater consistently fail on every updater run with the following error logged:
message: errors encountered during updater run
error: updating errors:
rhel-vex: unexpected response: unexpected status code: 404 Not Found (body starts: "<!DOCTYPE html>...
This is caused by a JSON file such as https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-26426.json being removed from the website after a https://security.access.redhat.com/data/csaf/v2/vex/changes.csv has been read that listed the file.
This unusual state may be triggered by the current state of RedHat's vex feed
I can't think of a bullet-proof definitive way for this to be perfect, but perhaps the rhel-vex updater could treat HTTP404 of an individual CVE json file to be a non-fatal error, log a warning, proceed assuming it's just been deleted. The CVE wouldn't be part of the in-progress update, subsequent update runs would find and add it again if it's a transient problem on the vex feed.
Since approx 2026-01-09 10:00UTC we're seeing the rhel-vex updater consistently fail on every updater run with the following error logged:
This is caused by a JSON file such as https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-26426.json being removed from the website after a https://security.access.redhat.com/data/csaf/v2/vex/changes.csv has been read that listed the file.
This unusual state may be triggered by the current state of RedHat's vex feed
and https://security.access.redhat.com/data/csaf/v2/vex/deletions.csv currently has 18,343 rows
https://status.redhat.com/incidents/6cqmnpcmqvrs
https://status.redhat.com/incidents/trq7cgsrhr3r
I can't think of a bullet-proof definitive way for this to be perfect, but perhaps the rhel-vex updater could treat HTTP404 of an individual CVE json file to be a non-fatal error, log a warning, proceed assuming it's just been deleted. The CVE wouldn't be part of the in-progress update, subsequent update runs would find and add it again if it's a transient problem on the vex feed.