| Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDerCVE-2026-119191 · GHSA-RHR8-3PM8-CQ29 |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsageCVE-2026-119189 · GHSA-H46V-RMH6-FQ4F |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Forge: Certificate signature verified with the issuer's RSA signature schemeCVE-2026-118774 · GHSA-9WG5-MJ3P-V49Q |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryptionCVE-2026-118776 · GHSA-2VGQ-WCHC-25W7 |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect TargetsCVE-2026-40895 · GHSA-R4Q5-VMMM-2653 |
follow-redirectsMigration Toolkit for Applications 8/mta/mta-ui-rhel8 |
npmRed Hat |
Medium
|
Fix reported |
|
| Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13CVE-2026-119190 · GHSA-5X38-2VFF-X55P |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientCVE-2026-118669 · GHSA-7984-QGVG-3J9C |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messageCVE-2026-119188 · GHSA-8HRF-8G6F-7XWP |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| Forge: Regular expression denial of service in PEM decoding (pem.decode)CVE-2026-118779 · GHSA-7WCH-P9PX-956X |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| Forge: Denial of service in TLS record processing via call stack exhaustionCVE-2026-119187 · GHSA-HQQ3-7JHF-C5JX |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingCVE-2026-119195 · GHSA-9M75-VC3G-4X39 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-complexity denial of service in binary REAL decodingCVE-2026-119197 · GHSA-MM57-4V3P-RCHX |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingCVE-2026-119194 · GHSA-FM9C-5RCF-2Q5P |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-CookieCVE-2026-118777 · GHSA-6WVX-3R32-XMCG |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storeCVE-2026-118780 · GHSA-4487-J8R4-4G2F |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| Forge: AES-GCM authentication bypass via unvalidated tagLength optionCVE-2026-119186 · GHSA-5CWG-6VW7-RJ6P |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Forge: ASN.1 OID first arc truncation in asn1.oidToDerCVE-2026-118775 · GHSA-4642-5MCJ-2RQW |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)CVE-2026-118781 · GHSA-H6CR-WJV9-3CPP |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
