Threat database

A vulnerability in jackson-databind affects versions from 2.0.0 up to but excluding 2.18.8, 2.21.4, and 3.1.4. The issue arises because the JDKFromStringDeserializer class eagerly resolves DNS names during deserialization of InetSocketAddress fields, potentially causing an attacker-controlled DNS query before application validation. The vulnerability is fixed by deferring DNS resolution until an explicit connect call. This flaw has a CVSS score of 7.5 and is rated as medium severity.

Red Hat has released a security advisory addressing multiple vulnerabilities in Red Hat Hardened Images RPMs, including updates to nodejs24 packages for aarch64 and x86_64 architectures. The advisory covers several CVEs such as CVE-2026-18149 and others. A patch is available to remediate these issues. The update includes bug fixes and enhancements to various nodejs24-related RPMs. The vulnerabilities are rated with high severity.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple nodejs22 packages to address a security vulnerability identified as CVE-2026-69152. The update includes various nodejs22 components for aarch64 and x86_64 architectures. No explicit affected versions are stated. The advisory does not mention any known exploits in the wild.

The 1.5.2 release of COO.

Red Hat has issued a critical security advisory for Multicluster Global Hub versions 1.6.0 through 1.6.5 addressing multiple vulnerabilities identified by CVE-2026-42306, CVE-2026-55969, and CVE-2026-66801. The advisory rates the security impact as critical but does not provide detailed CVSS scores or explicit patch details. No known exploits are reported in the wild. Users are advised to consult official Red Hat documentation for further information and updates.

These are all security issues fixed in the firefox-esr-140.13.0-1.1 package on the GA media of openSUSE Tumbleweed.

Two security vulnerabilities have been identified in Grafana as packaged for Red Hat Enterprise Linux 8. These include a privilege escalation vulnerability via dashboard overwrite (CVE-2026-33377) and a denial of service vulnerability caused by excessive memory allocation from large JSON payloads (CVE-2026-42127). Red Hat has issued an important security advisory with updates to address these issues. The affected versions are Red Hat Enterprise Linux 8 versions prior to 9.2.10-32.el8_10.1. The update is available and should be applied to mitigate these vulnerabilities.

A denial of service vulnerability (CVE-2026-42127) exists in Grafana distributed with Red Hat Enterprise Linux 9. The issue is caused by excessive memory allocation triggered by large JSON payloads. Red Hat has released a security update to address this vulnerability. The update is rated as important by Red Hat Product Security. No known exploits are reported in the wild.

The DevWorkspace Operator extends OpenShift to provide DevWorkspace support.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

These are all security issues fixed in the libssh2-1-1.11.1-4.1 package on the GA media of openSUSE Tumbleweed.

Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge device deployments and is built from the edge capabilities of Red Hat OpenShift Container Platform. MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at the edge, providing an efficient way to operate single-node clusters in these low-resource environments. This advisory contains the RPM packages for Red Hat build of MicroShift 4.19.42. Read the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:51007 Security Fix(es): * Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code (CVE-2026-35469) All Red Hat build of MicroShift 4.19 users are advised to use these updated packages and images when they are available in the RPM repository.

OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization v4.15 images.

OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization v4.20 images.

OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization v4.21 images.

A moderate severity vulnerability (CVE-2026-29168) exists in the mod_md module of Red Hat Enterprise Linux versions 9 and 10. This module automates certificate provisioning using the ACME protocol. The flaw allows unrestricted OCSP responses that can lead to resource exhaustion. Updates addressing this issue are available and should be applied to affected versions.

A high severity security vulnerability (CVE-2026-52490) exists in the libtiff library used by Red Hat Hardened Images RPMs. The flaw allows arbitrary code execution via the process_command_opts() function. Red Hat has released an update including libtiff version 4.7.2-2.hum1 to address this issue for multiple architectures including aarch64 and x86_64. No exploits are currently known in the wild.

Red Hat has released an important security advisory addressing multiple vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 10 and related CodeReady Linux Builder variants. The update fixes several security flaws including use-after-free, improper resource handling, and validation issues across various kernel subsystems such as fsnotify, shmem, futex, drm/amd/display, ipc, mm/slab, and openvswitch. A system reboot is required after applying the update to ensure the fixes take effect.

A vulnerability in Red Hat OpenShift Container Platform's oauth-proxy component allows an authenticated low-privilege user to impersonate another identity by exploiting header normalization differences in WSGI and PHP frameworks. The proxy sets authenticated identity headers using dash-variant keys but does not remove underscore-variant keys, which are normalized to the same variable upstream. This can lead to identity smuggling and potential impersonation. Red Hat has released OpenShift Container Platform 4.21.28 with fixes addressing this issue.