OpenShift Service Mesh 3/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9

Red Hat · Package

14 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review.	tracing-subscriber Confidential Compute Attestation/build-of-trustee/trustee-rhel9	Rust / CargoRed Hat	Low	Fix reported	2026-10-12
containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review.	github.com/containerd/containerd/v2 github.com/containerd/containerd	GoRed Hat	Medium	Fix reported	2026-09-10
js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M	js-yaml Cryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9	npmRed Hat	Medium	Fix reported	2026-09-10
filelock has a TOCTOU race condition which allows symlink attacks during lock file creationCVE-2025-68146 · GHSA-W853-JP5J-5J7FVersion ranges need review.	filelock Migration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8	PyPIRed Hat	Medium	Fix reported	2026-09-10
body-parser is vulnerable to denial of service when url encoding is usedCVE-2025-13466 · GHSA-WQCH-XFXH-VRR4	body-parser Cryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9	npmRed Hat	Medium	Fix reported	2026-09-10
node-forge is vulnerable to ASN.1 OID Integer TruncationCVE-2025-66030 · GHSA-65CH-62R8-G69G	node-forge Cryostat 4/io.cryostat-cryostat	npmRed Hat	Medium	Fix reported	2026-09-10
Vite middleware may serve files starting with the same name with the public directoryCVE-2025-58751 · GHSA-G4JQ-H2W9-997C	vite Cryostat 4/io.cryostat-cryostat	npmRed Hat	Low	Fix reported	2026-09-10
pip's fallback tar extraction doesn't check symbolic links point to extraction directoryCVE-2025-8869 · GHSA-4XH5-X5GV-QWPHVersion ranges need review.	pip Migration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-api-rhel9	PyPIRed Hat	Medium	Fix reported	2026-09-10
h2 allows HTTP Request Smuggling due to illegal characters in headersCVE-2025-57804 · GHSA-847F-9342-265HVersion ranges need review.	h2 OpenShift Service Mesh 3/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9	PyPIRed Hat	Medium	Fix reported	2026-09-10
Envoy forwards early CONNECT data in TCP proxy modeCVE-2025-64763 · GHSA-RJ35-4M94-77JH	github.com/envoyproxy/envoy OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8	GoRed Hat	Low	Fix reported	2025-12-11
Envoy crashes when JWT authentication is configured with the remote JWKS fetchingCVE-2025-64527 · GHSA-MP85-7MRQ-R866	github.com/envoyproxy/envoy OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8	GoRed Hat	Medium	Fix reported	2025-12-05
SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query SubscriptionsCVE-2025-11060 · GHSA-7VM2-J586-VCVC	SurrealDB OpenShift Service Mesh 3/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9	Rust / CargoRed Hat	Medium	Fix reported	2025-09-26
Koa Open Redirect via Referrer Header (User-Controlled)CVE-2025-8129 · GHSA-JGMV-J7WW-JX2X	koa OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8	npmRed Hat	Low	Fix reported	2025-08-05
envoy: Envoy Lua filter use-after-free when oversized rewritten response body causes crashCVE-2025-62504	OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8 OpenShift Service Mesh 2/openshift-service-mesh/istio-cni-rhel8	Red Hat	Medium	No fix reported	Not recorded