| Requests vulnerable to .netrc credentials leak via malicious URLsCVE-2024-47081 · GHSA-9HJG-9R4M-MVJ7Version ranges need review. |
requestsAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling SanitizationCVE-2026-42581 · GHSA-XXQH-MFJM-7MV9 |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsingCVE-2026-42580 · GHSA-M4CV-J2PX-7723 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-EncodingCVE-2026-42585 · GHSA-38F8-5428-X5CV |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request InjectionCVE-2026-41417 · GHSA-V8H7-RR48-VMMV |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
Medium
|
Fix reported |
|
| Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionCVE-2026-25645 · GHSA-GC5V-M9X4-R6X2Version ranges need review. |
requestsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoderCVE-2025-67735 · GHSA-84H7-RJJ3-6JX4 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden DirectoriesCVE-2025-11965 · GHSA-H5FG-JPGR-RV9C |
io.vertx:vertx-webCryostat 4/vertx-core |
MavenRed Hat |
Medium
|
Fix reported |
|
| Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file namesCVE-2025-11966 · GHSA-45P5-V273-3QQR |
io.vertx:vertx-webCryostat 4/vertx-web-client |
MavenRed Hat |
Low
|
Fix reported |
|
| Netty vulnerable to request smuggling due to incorrect parsing of chunk extensionsCVE-2025-58056 · GHSA-FGHV-69VJ-QJ49 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
Low
|
Fix reported |
|
| Netty affected by MadeYouReset HTTP/2 DDoS vulnerabilityCVE-2025-55163 · GHSA-PRJ3-CCX8-P6X4 |
io.grpc:grpc-netty-shadedio.netty:netty-codec-http2 |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputsCVE-2025-48924 · GHSA-J288-Q9X7-2F5V |
commons-lang:commons-langorg.apache.commons:commons-lang3 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2025-5197 · GHSA-9356-575X-2W9MVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameterCVE-2025-54798 · GHSA-52F5-9888-HMC6 |
tmpCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocationCVE-2025-49128 · GHSA-WF8F-6423-GFXG |
com.fasterxml.jackson.core:jackson-coreCryostat 4/jackson-core |
MavenRed Hat |
Medium
|
Fix reported |
|
| urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationCVE-2025-50181 · GHSA-PQ67-6M6Q-MJ2VVersion ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Starlette has possible denial-of-service vector when parsing large files in multipart formsCVE-2025-54121 · GHSA-2C2J-9GV5-CJ73Version ranges need review. |
starletteOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| on-headers is vulnerable to http response header manipulationCVE-2025-7339 · GHSA-76C9-3JPH-RJ3Q |
on-headersCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| Quarkus potentially leaks data when duplicating a duplicated contextCVE-2025-49574 · GHSA-9623-MJ7J-P9V4 |
io.quarkus:quarkus-vertxCryostat 4/quarkus-vertx |
MavenRed Hat |
Medium
|
Fix reported |
|
| urllib3 does not control redirects in browsers and Node.jsCVE-2025-50182 · GHSA-48P4-8XCF-VXJ5Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
