Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.15.70. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHSA-2026:82810
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/
Security Fix(es):
* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
* kernel: pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)
* kernel: sctp: prevent peer transport count overflow (CVE-2026-74469)
* kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)
* kernel: net: tun: bound receive headroom (CVE-2026-81000)
* gnutls: gnutls: Information disclosure via heap overread in RSA key exchange (CVE-2026-5260)
* glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014)
* glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.15.70. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:82810
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/
A critical vulnerability (CVE-2026-102785) affects the YOOtheme Pro extension for Joomla versions 5.0.0 through 5.0.52. The flaw involves an unauthenticated remote code execution via an image transformation handler that improperly validates request signatures. Attackers can reuse legitimate signatures to inject additional image operations, traverse directories, and upload a malicious PNG/PHP polyglot file to a publicly accessible media directory.
Applications that pass attacker-controlled URLs to `webpage` versions before
2.1.0 may be vulnerable to server-side request forgery (SSRF) or local file
disclosure.
`HTTP::fetch` and `Webpage::from_url` passed URLs to libcurl without
restricting the URL scheme or validating the resolved destination IP address.
Redirects were followed without checking whether the new destination was
internal. Depending on how the application uses the response, an attacker
could:
- Read local files accessible to the application process using `file://` URLs.
- Cause requests to internal or link-local services (e.g. cloud metadata
endpoints at `http://169.254.169.254`) via direct private-IP URLs or by
chaining HTTP redirects through an attacker-controlled server.
Starting in 2.1.0, `HTTP::fetch` and `Webpage::from_url` reject non-HTTP(S)
URL schemes and destinations that resolve to non-public IP addresses, including
after redirects. Applications that intentionally fetch trusted internal
resources can opt in to the previous behavior with `HTTP::fetch_unrestricted`
or `Webpage::from_url_unrestricted`.
Reported by [Aiden Mohan](https://github.com/AidenMohan).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data.
### Patches
This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4173](https://github.com/py-pdf/pypdf/pull/4173).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table.
### Patches
This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4170](https://github.com/py-pdf/pypdf/pull/4170).
### Notes
This has been reported through both the secure channel and as a public issue at [#4169](https://github.com/py-pdf/pypdf/issues/4169).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item.
### Patches
This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling `find_outline_item` on a `PdfWriter`.
### Patches
This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the `/DCTDecode` filter (JPEG data).
Users which do not have the optional *Pillow* dependency installed in their environment are not affected.
### Patches
This has been fixed in [pypdf==6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4222](https://github.com/py-pdf/pypdf/pull/4222).
CVE-2026-110974 is a vulnerability in the org.json parser within the com.vaadin.external.google:android-json library version 0.0.20131108.vaadin1. The parser uses uncontrolled recursion without a depth limit, causing a StackOverflowError when processing deeply nested JSON documents. This can cause the parsing thread to fail. No fixed version will be released for this artifact, which is an unmaintained repackaging of third-party org.json classes.
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version
Vaadin Framework 8.16.0 - 8.32.1
Mitigation
Upgrade to 8.32.2
Vaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue.
Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin:vaadin-server / 8.16.0 - 8.32.1 / >=8.32.2
com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2
CVE-2026-114490 is an incorrect authorization vulnerability in Progressive Robot Ltd's hMailServer versions 6.3.4 through 6.3.6. It affects the COM administration API, allowing accounts assigned the serveradmin role with a domain list to gain full server administrator privileges, bypassing intended domain restrictions. This enables unauthorized access to read, modify, and manage all domains and accounts on the server. The vulnerability also affects domainadmin roles with domain lists, granting broader access than intended. Accounts with serveradmin role but no domain list and other roles like help desk or auditor are not affected.
CVE-2026-114489 is a high-severity vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. It involves missing authorization checks in the REST and COM administration APIs, allowing remote authenticated users with domain-confined credentials to perform unauthorized changes to mail routing and domain configurations beyond their permitted domains on multi-tenant servers. Attackers can create domain aliases, rename domains, and modify mail routing rules to divert or deny mail for other tenants. The vulnerability arises from insufficient authorization enforcement in API handlers and COM API operations.
CVE-2026-111840 is a reflected cross-site scripting (XSS) vulnerability in VideoWhisper.com's Paid Videochat Turnkey Site affecting versions prior to 7.5.15. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability is rated high severity with a CVSS score of 7.1. A fix is available in version 7.5.15.
Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message.
Root Cause:
When processing an RTMP Abort (protocol control message type 2), the RTMP policy implementation deleted the target RtmpChunkStream object. The send path (RtmpUnsentMessage::AppendAndDestroySelf -> RtmpChunkStream::SerializeMessage) runs concurrently on sender threads and dereferences the same RtmpChunkStream object without synchronization. If a remote peer sends an Abort message naming a chunk stream that is concurrently being used to serialize an outgoing message, the stream object is freed while still in use, resulting in a use-after-free. Additionally, deleting the chunk stream discarded its previous message header, so subsequent compressed (type-3) chunk headers on that stream could no longer be decoded.
Affected Scenarios:
Any application using the bRPC RTMP protocol implementation (rtmp policy), either as an RTMP server or as an RTMP client, where the remote endpoint is untrusted. The attacker needs to send an Abort message targeting a chunk stream id that is concurrently used for sending, which can crash the process or lead to memory corruption.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3515
Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.
Root Cause:
The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.
Affected Scenarios:
Use bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3499
Note:
No matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.
Root Cause:
The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.
Affected Scenarios:
Apache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.
How to Fix:
(Choose one of the following options)
1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3325
Note:
The fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.52. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:83478
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/
Security Fix(es):
* kernel: pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.