Threats affecting pkg:generic/mongoose

Two security vulnerabilities have been identified in the python3.12-urllib3 package for Red Hat Enterprise Linux 9.4. The first is a denial of service vulnerability caused by unbounded memory allocation in the chunk parser (CVE-2026-97689). The second allows traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687). Red Hat has released an important security update addressing these issues.

Multiple security vulnerabilities have been identified and fixed in the dnsmasq packages used in Red Hat Enterprise Linux 8.4. These include heap buffer overflows, infinite loops, out-of-bounds reads, and source validation bypasses affecting DNS and DHCP functionalities. An update addressing these issues is available.

Multiple security vulnerabilities have been identified in Flatpak, a system for building and running sandboxed desktop applications on Linux. These include arbitrary code execution due to missing symlink protection, arbitrary root write access via extra-data extraction, a buffer overflow on 32-bit systems, and local privilege escalation via symlink traversal. Red Hat has issued a security update addressing these issues in Flatpak packages for Red Hat Enterprise Linux 8.4. Users are advised to apply the update to mitigate these vulnerabilities.

Red Hat OpenShift Container Platform 4.13.73 includes a critical security update addressing multiple vulnerabilities, notably a kernel IPv4 issue (CVE-2026-98432) involving freeing inet_opt and ireq_opt after an RCU grace period. This release fixes several bugs and security flaws across components such as OpenSSL, OpenSSH, GnuTLS, libxml2, and others. Users of OpenShift Container Platform 4.13 are advised to upgrade to this release to mitigate these critical vulnerabilities.

The npm package 'yummy-bolts' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.

Microsoft's November 2026 Patch Tuesday addresses 1095 vulnerabilities across multiple products, including 64 critical issues. Among these, 48 are remote code execution vulnerabilities. One vulnerability, CVE-2026-124194 in Microsoft Office Outlook, has been exploited in the wild and involves spoofing due to lack of UI warnings for unsafe actions. Several high-severity remote code execution and elevation of privilege vulnerabilities affect Windows components, Active Directory, Microsoft Exchange Server, and Microsoft Office applications. Microsoft highlights certain vulnerabilities as more likely to be exploited, including CVE-2026-113862 (Windows NAT), CVE-2026-118146 and CVE-2026-118148 (Active Directory), CVE-2026-118207 (Exchange Server), and CVE-2026-119952 (Windows Schannel).

The npm package @fadelsm/libsignal-node contains malicious code that compromises any computer on which it is installed or running. Systems with this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a different, trusted device. Removing the package does not guarantee removal of all malicious software introduced by it.

This Red Hat security advisory addresses multiple vulnerabilities and bug fixes in the Linux kernel packages for Red Hat Enterprise Linux 9. The update includes fixes for numerous security issues such as NULL pointer dereferences, use-after-free conditions, out-of-bounds writes, memory corruption, and denial of service vulnerabilities across various kernel subsystems including networking, USB, Bluetooth, RDMA, and virtualization. The advisory emphasizes the importance of applying the update and rebooting the system to mitigate these issues.

The npm package pt-logger-telemetry-eax0x1 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.

A denial of service vulnerability exists in Gitoxide before version 0.42.0 caused by processing a crafted commit-graph file. This flaw can cause the affected software to become unavailable or crash when handling maliciously crafted input.

CVE-2026-123532 is a vulnerability in gix-fs before version 0.24.1 that allows NTLM credential disclosure via a Windows symlink UNC probe. The affected product is Microsoft software version 3.0. No CVSS score or detailed impact information is provided.

CVE-2026-113431 is a vulnerability in the cowlib cow_http2_machine component where the decoded HTTP/2 header-list size is unbounded. This flaw enables HPACK amplification memory exhaustion, potentially leading to resource exhaustion on affected systems. The issue affects Microsoft product version 3.0. No CVSS score or public exploit code is currently available.

An uncontrolled resource consumption vulnerability exists in the HTTP response handling component of the Qt Network module within the Qt Framework. This vulnerability could potentially lead to resource exhaustion conditions. The affected version explicitly identified is Qt Framework version 3.0. No CVSS score or detailed exploitation information is provided.

A vulnerability identified as CVE-2026-120474 affects version 3.0 of the undici HTTP client library. The issue involves cross-user cache disclosure via same-origin redirects, which could lead to unintended information leakage between users. No CVSS score or detailed impact metrics are provided. No known exploits in the wild have been reported, and no patch or remediation details are available from the vendor.

The undici HTTP client version 3.0 is vulnerable to a denial of service condition caused by an unhandled exception during cache-interceptor response replay. This flaw can cause the application using undici to crash or become unresponsive when the exception occurs.

A vulnerability identified as CVE-2026-116630 affects version 3.0 of the Microsoft product undici. It involves cross-user information disclosure through cross-origin redirect revalidation. No CVSS score or detailed impact information is provided. No patch or remediation details are available from the vendor at this time.

A vulnerability identified as CVE-2026-120423 affects the undici library version 3.0, allowing a Subresource Integrity (SRI) bypass via whitespace in integrity metadata. This could potentially undermine the security guarantees provided by SRI checks.

The undici library version 3.0 is vulnerable to cache poisoning and cross-user data disclosure through intermediate redirect hops. This vulnerability involves improper handling of redirects that can lead to unauthorized data exposure between users.

A vulnerability identified as CVE-2026-120415 affects the undici HTTP client library version 3.0. This flaw allows cross-origin credential disclosure by bypassing redirect stripping through the use of array-of-tuples headers. The issue is categorized under CWE-200, indicating information exposure. No CVSS score or detailed impact metrics are provided.