| Ruby json: JSON generator heap buffer overflow when streaming to an IOCVE-2026-54696 · GHSA-X2F5-4PRF-W687 |
Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 |
Red HatRubyGems |
کم
|
اصلاح گزارش شده |
|
| Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerCVE-2026-34230 · GHSA-V569-HP3G-36WR |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter valuesCVE-2026-26962 · GHSA-RX22-G9MX-QRHV |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack's multipart byte range processing allows denial of service via excessive overlapping rangesCVE-2026-34826 · GHSA-X8CG-FQ8G-MXFX |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack has Content-Length mismatch in Rack::Files error responsesCVE-2026-34831 · GHSA-Q2WW-5357-X388 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-RedirectCVE-2026-34830 · GHSA-QV7J-4883-HWH7 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack: Forwarded Header semicolon injection enables Host and Scheme spoofingCVE-2026-32762 · GHSA-QFGR-CRR9-7R49 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack:: Static header_rules bypass via URL-encoded pathsCVE-2026-34786 · GHSA-Q4QF-9J86-F5MH |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53بازه‌ها نیاز به بررسی دارند. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| URI Credential Leakage Bypass over CVE-2025-27221CVE-2025-61594 · GHSA-J4PR-3WM6-XX2R |
Logging Subsystem for Red Hat OpenShift/openshift-logging/fluentd-rhel9Red Hat Enterprise Linux 10/ruby |
Red HatRubyGems |
کم
|
اصلاح گزارش شده |
|
| Rack::Request accepts invalid Host characters, enabling host allowlist bypassCVE-2026-34835 · GHSA-G2PF-XV49-M2H5 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack has a root directory disclosure via unescaped regex interpolation in Rack::DirectoryCVE-2026-34763 · GHSA-7MQQ-6CF9-V2QP |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefCVE-2026-25500 · GHSA-WHRJ-4476-WVMP |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)CVE-2026-21441 · GHSA-38JV-5279-WG99بازه‌ها نیاز به بررسی دارند. |
urllib3External Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| glob CLI: Command injection via -c/--cmd executes matches with shell:trueCVE-2025-64756 · GHSA-5J98-MCP5-4VW2 |
globLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-curator5-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)CVE-2025-61772 · GHSA-WPV5-97WM-HP9C |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| Escape Sequence Injection vulnerability in Rack lead to Possible Log InjectionCVE-2025-27111 · GHSA-8CGQ-6MH2-7J6V |
Logging Subsystem for Red Hat OpenShift/openshift-logging/fluentd-rhel9Red Hat 3scale API Management Platform 2/3scale-amp2/zync-rhel9 |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Possible DoS by memory exhaustion in net-imapCVE-2025-25186 · GHSA-7FC5-F82F-CX69 |
Red Hat 3scale API Management Platform 2/3scale-amp2/zync-rhel8Red Hat Enterprise Linux 10/rhel10-beta/flatpak-sdk |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| openssl: Timing side-channel in ECDSA signature computationCVE-2024-13176 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/fluentd-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8 |
Red Hat |
کم
|
اصلاح اعلام نشده |
|
| resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnamesCVE-2026-80213 |
Lightspeed Core/lightspeed-core/rag-tool-cpu-rhel9Lightspeed Core/lightspeed-core/rag-tool-cuda-12.9-rhel9 |
Red Hat |
متوسط
|
اصلاح اعلام نشده |
|
