| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocationCVE-2026-102554 · GHSA-XXPH-C9WW-HJ94 |
com.google.guava:guavaExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37بازه‌ها نیاز به بررسی دارند. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guardCVE-2026-13506 · GHSA-QP49-QGX5-5M26 |
org.bouncycastle:bc-fipsorg.bouncycastle:bcprov-jdk15to18 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing BypassCVE-2026-59900 · GHSA-C69G-56F8-XWQJ |
io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validationCVE-2026-59898 · GHSA-4MP9-239F-G9HG |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V |
brace-expansionCryostat 4/brace-expansion |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setCVE-2026-8723 · GHSA-Q8MJ-M7CP-5Q26 |
qsConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| body-parser vulnerable to denial of service when invalid limit value silently disables size enforcementCVE-2026-12590 · GHSA-V422-HMWV-36X6 |
body-parserConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoderCVE-2026-59921 · GHSA-GCJF-9MGH-3P7G |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permittedCVE-2026-50020 · GHSA-HVCG-QMG6-JM4C |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signatureCVE-2026-50560 · GHSA-563Q-J3CM-6JXM |
io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforcedCVE-2026-47244 · GHSA-5X3R-WRVG-RP6Q |
io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsCVE-2026-4923 · GHSA-27V5-C462-WPQ7 |
path-to-regexpCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContextCVE-2026-75595 · GHSA-C4C3-7FPV-J4Q5 |
io.netty:netty-handlerRed Hat AMQ Clients/netty-handler |
MavenRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parametersCVE-2026-4867 · GHSA-37CH-88JC-XWX2 |
path-to-regexpCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| che-machine-exec: Unauthenticated Command Injection via kubeconfig Username in che-machine-execCVE-2026-114278 |
Red Hat OpenShift Dev Spaces/devspaces/code-rhel9Red Hat OpenShift Dev Spaces/devspaces/jetbrains-ide-rhel9 |
Red Hat |
زیاد
|
اصلاح اعلام نشده |
|
