| OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiCVE-2026-114603 · GHSA-XCQ7-P3PF-P88H |
opentelemetry-apiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Ruby json: JSON generator heap buffer overflow when streaming to an IOCVE-2026-54696 · GHSA-X2F5-4PRF-W687 |
Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 |
Red HatRubyGems |
کم
|
اصلاح گزارش شده |
|
| Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`CVE-2026-57435 · GHSA-PHWJ-RPRQ-35PP |
Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 |
Red HatRubyGems |
کم
|
اصلاح گزارش شده |
|
| Nokogiri: Possible Use-After-Free in XInclude ProcessingCVE-2026-57438 · GHSA-WFPW-MMFH-QQ69 |
Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 |
Red HatRubyGems |
کم
|
اصلاح گزارش شده |
|
| Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetimeCVE-2026-57437 · GHSA-P67V-3W7G-WJG7 |
Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 |
Red HatRubyGems |
کم
|
اصلاح گزارش شده |
|
| Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`CVE-2026-57235 · GHSA-5PRR-V3J2-97MH |
Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerCVE-2026-34230 · GHSA-V569-HP3G-36WR |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter valuesCVE-2026-26962 · GHSA-RX22-G9MX-QRHV |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack's multipart byte range processing allows denial of service via excessive overlapping rangesCVE-2026-34826 · GHSA-X8CG-FQ8G-MXFX |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack has Content-Length mismatch in Rack::Files error responsesCVE-2026-34831 · GHSA-Q2WW-5357-X388 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-RedirectCVE-2026-34830 · GHSA-QV7J-4883-HWH7 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack: Forwarded Header semicolon injection enables Host and Scheme spoofingCVE-2026-32762 · GHSA-QFGR-CRR9-7R49 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack:: Static header_rules bypass via URL-encoded pathsCVE-2026-34786 · GHSA-Q4QF-9J86-F5MH |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack's multipart parsing without Content-Length header allows unbounded chunked file uploadsCVE-2026-34829 · GHSA-8VQR-QJWX-82MW |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| REXML denial of service vulnerabilityCVE-2024-43398 · GHSA-VMWR-MC7X-5VC3 |
Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node typeCVE-2026-57436 · GHSA-WJV4-X9W8-WM3H |
Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 |
Red HatRubyGems |
کم
|
اصلاح گزارش شده |
|
| Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivityCVE-2026-54905 · GHSA-WV3X-4VXV-WHPP |
Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 |
Red HatRubyGems |
کم
|
اصلاح گزارش شده |
|
| Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classesCVE-2026-57434 · GHSA-9CV2-CFXC-V4V2 |
Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 |
Red HatRubyGems |
کم
|
اصلاح گزارش شده |
|
| Nokogiri XSLT transform has a memory leakCVE-2026-79771 · GHSA-V2FC-QM4H-8HQV |
Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8 |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack::Request accepts invalid Host characters, enabling host allowlist bypassCVE-2026-34835 · GHSA-G2PF-XV49-M2H5 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
