Threats tagged 'alpine'

CVE-2026-33818 is a high-severity denial-of-service vulnerability in the Go standard library's encoding/asn1 component. It allows an attacker to cause uncontrolled resource consumption via malformed inputs, leading to denial of service. Red Hat has released updated Hardened Images RPMs containing patched versions of Go 1.25.13 to remediate this and related issues. The vulnerability affects various Red Hat products that include these Go components. No known exploits are reported in the wild.

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1.7.1, XP 6.0.5.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Security Fix(es): * memory exhaustion in io.netty:netty-codec-haproxy (CVE-2026-48059) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-47691) * DDoS in io.netty:netty-codec-http2 (CVE-2026-50560) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-50011) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44250) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44890) * IPv6 subnet filter bypass in io.netty:netty-handler (CVE-2026-44249) * request smuggling in io.netty:netty-codec-http (CVE-2026-50020) * memory leak in io.netty:netty-codec-haproxy (CVE-2026-44893) * TLS hostname verification accidentally disabled in io.netty:netty-handler (CVE-2026-50010) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45673) * excessive memory usage from SNIHandler in io.netty:netty-handler (CVE-2026-45416) * file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue (CVE-2026-45536) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45674) * memory exhaustion in io.netty:netty-transport-sctp (CVE-2026-46340) * denial of service in io.netty:netty-codec-http2 (CVE-2026-47244) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-48006) * memory exhaustion in io.netty:netty-codec-http2 (CVE-2026-48043) * netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Migration Toolkit for Applications (MTA) accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. This solution provides insight throughout the adoption process, at both the portfolio and application levels: inventory, assess, analyze, and manage applications for faster migration to OpenShift via the user interface.

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is an update for Red Hat JBoss Enterprise Application Platform 8.1. See Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) * netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) * netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) * netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package akhq version 0.27.1-r5 fixes 27 vulnerabilities: CVE-2026-58062, CVE-2026-59638, CVE-2026-59646, CVE-2026-12802, CVE-2026-59639...

rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fix(es): * golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update includes the following RPMs: cosign: * cosign-3.1.2-0.2.hum1 (aarch64, x86_64) * cosign-3.1.2-0.2.hum1.src (src) Security Fix(es): cosign: * CVE-2026-56852

The kubernetes-dns-node-cache package version 1.26.8-r6 addresses two vulnerabilities including CVE-2026-50274. This vulnerability is classified under CWE-770 and affects versions prior to 1.26.8-r6, including versions less than or equal to 1.24.1 and less than 2.8.1. The issue has been assigned a high severity rating. A patch is available to remediate the vulnerability.

Package langfuse-worker version 3.194.1-r1 fixes 30 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, CVE-2026-50272, ghsa-55q2-fjhq-7xh7, CVE-2026-65898...

CVE-2026-49844 is a medium severity vulnerability in Apache Log4j2 where improper encoding of non-finite floating-point values during MapMessage JSON serialization results in output that is not valid JSON. This issue affects multiple specific versions of Apache Log4j2 prior to version 2.1.3-r1. A patch is available that addresses this and other vulnerabilities in the affected software.

Submariner is a Kubernetes operator that enables cross-cluster connectivity for services and pods, implementing KEP-1645 (Multi-Cluster Services API). After deploying the Submariner operator, it can enable direct networking between pods and services across different Kubernetes clusters. For more information about Submariner, see the Submariner open source community website at: https://submariner.io/.

This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * None Known issues: * None

CVE-2026-42505 is a medium severity vulnerability affecting multiple versions of the golang-1.10 package and related Ubuntu and SUSE packages. It involves potential de-anonymization of handshakes using Encrypted Client Hello due to disclosure of pre-shared key identities. Multiple security issues including this vulnerability were fixed in the tekton-cli-0.46.0-1.1 package on openSUSE Tumbleweed. A patch is available to remediate these issues.

CVE-2026-59873 is a medium severity vulnerability in the node-tar package affecting multiple specific versions prior to 7.5.19. The flaw involves insufficient enforcement of hard upper bounds on total decompressed data, entry counts, or decompression ratio during archive extraction. This can potentially lead to resource exhaustion or denial of service. The issue is fixed in renovate version 44.32.4-r1 and later. No known exploits have been reported in the wild.

These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed.

Multiple security vulnerabilities affecting the cosign tool and related Go cryptography libraries have been identified and fixed. These include issues parsing HTML files, a memory-safety vulnerability, and multiple issues in golang.org/x/crypto/ssh. The vulnerabilities have been addressed in updated versions provided by SUSE and Red Hat. A patch is available to remediate these issues.

This update includes the following RPMs: jaeger: * jaeger-2.19.0-1.hum1 (aarch64, x86_64) * jaeger-2.19.0-1.hum1.src (src)

Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

CVE-2026-39827 is a vulnerability in the golang-go.crypto SSH client where repeatedly opening channels that are rejected by the server causes unbounded memory growth, eventually crashing the server process and impacting all connected users. The issue is due to rejected channels not being properly removed from the connection's internal state. This has been fixed by ensuring rejected channels are released for garbage collection.

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.