Skip to content
Security
فارسی
Sign in / Register
Vulnerabilities
Products
Plugins
All products
OpenShift Service Mesh 3/openshift-service-mesh/istio-ztunnel-rhel9
Red Hat
· Package
16 reports
Vulnerability alerts
Follow
Package, identifier or title
Search
Severity
All
Critical
High
Medium
Low
Unknown
Fix status
All
Fix reported
No fix reported
Sort by
Recently updated
Highest severity
Report
Product
Ecosystem
Severity
Fix status
Last updated
Tokio: Race condition in `tokio::time::Interval`
CVE-2026-115567 · GHSA-5WJR-9356-4WC8
Version ranges need review.
tokio
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9
Rust / Cargo
Red Hat
Medium
Fix reported
2026-10-24
webpki: Name constraints were accepted for certificates asserting a wildcard name
CVE-2026-93601 · GHSA-XGP8-3HG3-C2MH
Version ranges need review.
rustls-webpki
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9
Rust / Cargo
Red Hat
Low
Fix reported
2026-09-19
webpki: Name constraints for URI names were incorrectly accepted
CVE-2026-93600 · GHSA-965H-392X-2MH5
Version ranges need review.
rustls-webpki
Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9
Rust / Cargo
Red Hat
Low
Fix reported
2026-09-19
webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic
CVE-2026-93602 · GHSA-PWJX-QHCG-RVJ4
Version ranges need review.
rustls-webpki
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9
Rust / Cargo
Red Hat
Medium
Fix reported
2026-09-19
containerd CRI server: Host memory exhaustion through Attach goroutine leak
CVE-2025-64329 · GHSA-M6HQ-P25P-FFR2
Version ranges need review.
github.com/containerd/containerd/v2
github.com/containerd/containerd
Go
Red Hat
Medium
Fix reported
2026-09-10
js-yaml has prototype pollution in merge (<<)
CVE-2025-64718 · GHSA-MH29-5H37-FV8M
js-yaml
Cryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9
npm
Red Hat
Medium
Fix reported
2026-09-10
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
CVE-2025-68146 · GHSA-W853-JP5J-5J7F
Version ranges need review.
filelock
Migration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8
PyPI
Red Hat
Medium
Fix reported
2026-09-10
body-parser is vulnerable to denial of service when url encoding is used
CVE-2025-13466 · GHSA-WQCH-XFXH-VRR4
body-parser
Cryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9
npm
Red Hat
Medium
Fix reported
2026-09-10
node-forge is vulnerable to ASN.1 OID Integer Truncation
CVE-2025-66030 · GHSA-65CH-62R8-G69G
node-forge
Cryostat 4/io.cryostat-cryostat
npm
Red Hat
Medium
Fix reported
2026-09-10
Envoy forwards early CONNECT data in TCP proxy mode
CVE-2025-64763 · GHSA-RJ35-4M94-77JH
github.com/envoyproxy/envoy
OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8
Go
Red Hat
Low
Fix reported
2025-12-11
Envoy's TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte
CVE-2025-66220 · GHSA-RWJG-C3H2-F57P
github.com/envoyproxy/envoy
OpenShift Service Mesh 3/openshift-service-mesh/istio-proxyv2-rhel9
Go
Red Hat
Medium
Fix reported
2025-12-05
Envoy crashes when JWT authentication is configured with the remote JWKS fetching
CVE-2025-64527 · GHSA-MP85-7MRQ-R866
github.com/envoyproxy/envoy
OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8
Go
Red Hat
Medium
Fix reported
2025-12-05
uuid: uuid: Unexpected data writes when using external output buffers with specific UUID versions
CVE-2026-41988
Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9
Confidential Cluster Operator/confidential-clusters-beta/buildroot-rhel9
Red Hat
Low
No fix reported
Not recorded
org.hdrhistogram/HdrHistogram: HdrHistogram: HdrHistogram: Denial of Service via uncontrolled memory allocation in decodeFromByteBuffer
CVE-2026-14684
Logging Subsystem for Red Hat OpenShift/openshift-logging/vector-rhel9
OpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9
Red Hat
Low
No fix reported
Not recorded
nix: Nix: Arbitrary file truncation via time-of-check/time-of-use race
CVE-2026-64846
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9
Confidential Compute Attestation/agent-sandbox/agent-sandbox-router
Red Hat
Low
No fix reported
Not recorded
openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()
CVE-2026-75803
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9
Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9
Red Hat
Low
No fix reported
Not recorded
