Security
فارسی
All products

Red Hat Enterprise Linux 8/ubi8/s2i-base

Red Hat · Package
18 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectsCVE-2026-109829 · GHSA-4W7W-5XRC-9H26 undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat High Fix reported
undici vulnerable to TLS certificate validation bypass via dropped tls options in AgentCVE-2026-109383 · GHSA-2M5V-PCH6-74HX undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat High Fix reported
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationCVE-2026-87018 · GHSA-QRXM-FQHP-JWVM undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat High Fix reported
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingCVE-2026-109932 · GHSA-9FM3-97PX-RJF6 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptorCVE-2026-87029 · GHSA-55WC-3PG8-JFW6 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsCVE-2026-109869 · GHSA-XJJ6-F33Q-929C undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat High Fix reported
undici vulnerable to Denial of Service via unbounded memory in the EventSource parserCVE-2026-109924 · GHSA-4QV8-2P9J-2685 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensCVE-2026-109841 · GHSA-F72V-6W45-Q472 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 PyPIRed Hat High Fix reported
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksCVE-2026-69198 · GHSA-4XRF-JV44-H6HH ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsCVE-2026-59875 · GHSA-GVWX-54WH-QM9J tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)CVE-2026-21441 · GHSA-38JV-5279-WG99Version ranges need review. urllib3External Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 PyPIRed Hat High Fix reported
glob CLI: Command injection via -c/--cmd executes matches with shell:trueCVE-2025-64756 · GHSA-5J98-MCP5-4VW2 globLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-curator5-rhel9 npmRed Hat High Fix reported
http-cache-semantics: http-cache-semantics: Information disclosure via improper Vary header wildcard validationCVE-2026-93750 Confidential Compute Attestation/build-of-trustee/trustee-rhel9Exploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 Red Hat Medium No fix reported