Bundesamt für Sicherheit in der Informationstechnik Atlassian · Red Hat Advanced Cluster Security: Schwachstelle ermöglicht Denial of Service
Affects Bundesamt für Sicherheit in der Informationstechnik AtlassianSource GCVE Database
Not known to be exploited : upgrade to 10.0.2 when convenient.
Data as of 13 Nov 2026, 20:15 UTC
Rated Low by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
- Patch
- Available – fixed in 10.0.2
Exploitation evidence
Disclosed: evidence found.
CVE published 1 Dec 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 13 Nov 2026.
What to do
Upgrade Bundesamt für Sicherheit in der Informationstechnik Atlassian to 10.0.2.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Bundesamt für Sicherheit in der Informationstechnik Atlassian | Affected
| Fixed in
|
AI-suggested
Red Hat has provided official fixes for this vulnerability in RHACS version 4.4.7 and OpenShift Service Mesh version 2.4.13. Users are advised to upgrade to these patched versions to remediate the issue. No additional mitigation steps are required beyond applying the official updates.
Description
CVE-2024-21538 is a regular expression denial of service (ReDoS) vulnerability affecting Red Hat Advanced Cluster Security (RHACS) for Kubernetes and Red Hat OpenShift Service Mesh. The issue is addressed in RHACS version 4.4.7 and OpenShift Service Mesh 2.4.13. The vulnerability allows an attacker to cause denial of service by exploiting inefficient regular expression processing in the 'cross-spawn' component. The severity is rated as low by Red Hat.
References
- wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3573.json (opens in a new tab)
- wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3573 (opens in a new tab)
- access.redhat.com/errata/RHSA-2024:10665 (opens in a new tab)
- lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ORBQAMKYVB4ADL73JD3ZYOHHQFASC62K/ (opens in a new tab)
- access.redhat.com/errata/RHSA-2024:10907 (opens in a new tab)
- access.redhat.com/errata/RHSA-2024:10908 (opens in a new tab)
- lists.suse.com/pipermail/sle-security-updates/2024-December/019977.html (opens in a new tab)
- access.redhat.com/errata/RHSA-2024:10839 (opens in a new tab)
- access.redhat.com/errata/RHSA-2024:10986 (opens in a new tab)
- lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/XJM7QK6PZLAUXM2CGIPOAPZOBRWNZ2MZ/ (opens in a new tab)
- access.redhat.com/errata/RHSA-2024:11292 (opens in a new tab)
- access.redhat.com/errata/RHSA-2024:11031 (opens in a new tab)
- access.redhat.com/errata/RHSA-2025:0079 (opens in a new tab)
- access.redhat.com/errata/RHSA-2025:0164 (opens in a new tab)
- access.redhat.com/errata/RHSA-2025:2652 (opens in a new tab)
- access.redhat.com/errata/RHSA-2025:8510 (opens in a new tab)
- access.redhat.com/errata/RHSA-2025:8551 (opens in a new tab)
- confluence.atlassian.com/security/security-bulletin-november-18-2025-1671463469.html (opens in a new tab)