Security
فارسی
All products

Red Hat 3scale API Management Platform 2/3scale-amp25/backend

Red Hat · Package
14 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerCVE-2026-34230 · GHSA-V569-HP3G-36WR Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems High Fix reported
Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter valuesCVE-2026-26962 · GHSA-RX22-G9MX-QRHV Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack's multipart byte range processing allows denial of service via excessive overlapping rangesCVE-2026-34826 · GHSA-X8CG-FQ8G-MXFX Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack has Content-Length mismatch in Rack::Files error responsesCVE-2026-34831 · GHSA-Q2WW-5357-X388 Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-RedirectCVE-2026-34830 · GHSA-QV7J-4883-HWH7 Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack: Forwarded Header semicolon injection enables Host and Scheme spoofingCVE-2026-32762 · GHSA-QFGR-CRR9-7R49 Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack:: Static header_rules bypass via URL-encoded pathsCVE-2026-34786 · GHSA-Q4QF-9J86-F5MH Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack's multipart parsing without Content-Length header allows unbounded chunked file uploadsCVE-2026-34829 · GHSA-8VQR-QJWX-82MW Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems High Fix reported
Rack::Request accepts invalid Host characters, enabling host allowlist bypassCVE-2026-34835 · GHSA-G2PF-XV49-M2H5 Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parametersCVE-2026-34827 · GHSA-V6X5-CG8R-VV6X Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems High Fix reported
Rack has a root directory disclosure via unescaped regex interpolation in Rack::DirectoryCVE-2026-34763 · GHSA-7MQQ-6CF9-V2QP Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefCVE-2026-25500 · GHSA-WHRJ-4476-WVMP Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack has a Directory Traversal via Rack:DirectoryCVE-2026-22860 · GHSA-MXW3-3HH2-X2MH Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel7Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8 Red HatRubyGems High Fix reported
ydb: ydb: Denial of Service via memory leakCVE-2026-24825 Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red Hat Medium No fix reported