| Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden charactersCVE-2026-34479 · GHSA-H383-GMXW-35V2 |
org.apache.logging.log4j:log4j-coreRed Hat Data Grid 8/log4j-1.2-api |
MavenRed Hat |
Medium
|
Fix reported |
|
| Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocksCVE-2025-14813 · GHSA-574F-3G2M-X479 |
org.bouncycastle:bcprov-debug-jdk14org.bouncycastle:bcprov-debug-jdk15on |
MavenRed Hat |
Critical
|
Fix reported |
|
| Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling SanitizationCVE-2026-42581 · GHSA-XXQH-MFJM-7MV9 |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsingCVE-2026-42580 · GHSA-M4CV-J2PX-7723 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-EncodingCVE-2026-42585 · GHSA-38F8-5428-X5CV |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request InjectionCVE-2026-41417 · GHSA-V8H7-RR48-VMMV |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
Medium
|
Fix reported |
|
| Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modulesCVE-2026-5588 · GHSA-WG6Q-6289-32HP |
org.bouncycastle:bcpkix-debug-jdk14org.bouncycastle:bcpkix-debug-jdk15to18 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configurationCVE-2026-34477 · GHSA-6HG6-V5C8-FPHQ |
org.apache.logging.log4j:log4j-coreRed Hat AI Inference Server/redhat-user-workloads/rhaiis-cuda-ubi9-3-2-2 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame BypassCVE-2026-33871 · GHSA-W9FJ-CFPG-GRVV |
io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 |
MavenRed Hat |
High
|
Fix reported |
|
| Netty: HTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-33870 · GHSA-PWQR-WMGM-9RR8 |
io.netty:netty-codec-httpLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Log4j does not verify the TLS hostname in its Socket AppenderCVE-2025-68161 · GHSA-VC5P-V9HR-52MJ |
org.apache.logging.log4j:log4j-coreLogging Subsystem for Red Hat OpenShift/log4j-core |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoderCVE-2025-67735 · GHSA-84H7-RJJ3-6JX4 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty vulnerable to request smuggling due to incorrect parsing of chunk extensionsCVE-2025-58056 · GHSA-FGHV-69VJ-QJ49 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
Low
|
Fix reported |
|
| Netty affected by MadeYouReset HTTP/2 DDoS vulnerabilityCVE-2025-55163 · GHSA-PRJ3-CCX8-P6X4 |
io.grpc:grpc-netty-shadedio.netty:netty-codec-http2 |
MavenRed Hat |
High
|
Fix reported |
|
| Bouncy Castle for Java Uncontrolled Resource Consumption VulnerabilityCVE-2025-9092 · GHSA-V6CF-MV9H-C8MC |
org.bouncycastle:bc-fipsCryostat 4/bcpkix-jdk18on |
MavenRed Hat |
Low
|
Fix reported |
|
| Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputsCVE-2025-48924 · GHSA-J288-Q9X7-2F5V |
commons-lang:commons-langorg.apache.commons:commons-lang3 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Bouncy Castle for Java on All (API modules) allows Excessive AllocationCVE-2025-8885 · GHSA-67MF-3CR5-8W23 |
org.bouncycastle:bc-fipsorg.bouncycastle:bcprov-jdk14 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2025-5197 · GHSA-9356-575X-2W9MVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameterCVE-2025-54798 · GHSA-52F5-9888-HMC6 |
tmpCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive AllocationCVE-2025-8916 · GHSA-4CX2-FC23-5WG6 |
org.bouncycastle:bcpkix-fipsorg.bouncycastle:bcpkix-jdk15on |
MavenRed Hat |
Medium
|
Fix reported |
|
