Threat database

Red Hat has issued a security advisory for the pcs packages used in configuring Pacemaker and Corosync utilities. The update addresses three vulnerabilities: two Tornado quadratic denial-of-service (DoS) issues (CVE-2025-67725 and CVE-2025-67726) and a prototype pollution vulnerability in lodash functions _.unset and _.omit (CVE-2025-13465). These vulnerabilities have been rated as important by Red Hat. The advisory provides updated package versions for Red Hat Enterprise Linux 8.6 variants to remediate these issues.

A denial of service vulnerability (CVE-2026-23490) exists in the pyasn1 library used by the resource-agents packages in Red Hat Enterprise Linux. The flaw involves memory exhaustion triggered by a malformed RELATIVE-OID. This affects service manager scripts used in high-availability environments. Red Hat has issued an important security update to address this issue in resource-agents for RHEL 8.8 variants.

Red Hat OpenShift Dev Spaces 3.25.0 has been released as a critical security advisory. This release is based on Eclipse Che 7.111 and supports workspaces using devfile v2.1 and v2.2 standards. Users still using the older v1 devfile standard are advised to migrate promptly. The product supports OpenShift EUS releases v4.16 and higher, and users should update to supported OpenShift versions to continue receiving updates.

Red Hat OpenShift Container Platform 4.13.62 is a bug fix and security update release that addresses several bugs and adds enhancements. According to the vendor advisory, this update includes no new security fixes. The security impact of this release is rated as Low by Red Hat Product Security. Users of OpenShift Container Platform 4.13 are advised to upgrade to this release when available through their appropriate release channels.

Multiple security vulnerabilities were discovered in the Linux kernel for Raspberry Pi, Raspberry Pi Real-time, and Xilinx systems. These include a branch predictor isolation flaw known as VMSCAPE (CVE-2025-40300) that could allow an attacker in a guest VM to expose sensitive information from the host OS. Additional flaws affect the HSI, Bluetooth, and Timer subsystems. Updates correcting these issues have been released and require a system reboot and recompilation of third-party kernel modules due to ABI changes.