Threats Tagged 'cve-2026-14257'

Red Hat® AI Inference Server

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.44. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:57401 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

Red Hat Ansible Automation Platform versions 2.1 and 2.2 include Ansible plug-ins for Red Hat Developer Hub that enhance automation. A Red Hat security advisory (RHSA-2026:65118) lists multiple CVEs including CVE-2026-5079 but does not provide specific vulnerability details or confirm patches. Updated images with new features and bug fixes are available, but no explicit fixes for the listed CVEs are stated.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.

Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.22.7. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:44237 Security Fix(es): * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization (CVE-2026-13676) * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

CVE-2026-14257 is a high-severity vulnerability in the juliangruber brace-expansion library (versions up to 5.0.7) that allows an attacker to cause uncontrolled memory consumption. The expand() function limits the number of results but not their length, enabling crafted inputs with many chained brace groups to exhaust memory and crash the Node.js process with an uncatchable out-of-memory error. This denial-of-service condition cannot be caught by try/catch and results in a fatal process termination. The vulnerability affects applications that pass attacker-controlled strings to brace-expansion.expand(), including via minimatch or glob patterns. A patch has been released that bounds the total output length to prevent unbounded memory growth.

Kiali 2.27.3, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently. Security Fix(es): * CVE-2026-45623 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15115) * CVE-2026-45623 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15110) * CVE-2026-54272 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15124) * CVE-2026-54272 openshift-service-mesh/kiali-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15125) * CVE-2026-69153 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15160) * CVE-2026-69153 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15164) * CVE-2026-69152 openshift-service-mesh/kiali-ossmc-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15178) * CVE-2026-69152 openshift-service-mesh/kiali-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15179) * CVE-2026-69192 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15188) * CVE-2026-69192 openshift-service-mesh/kiali-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15189) * CVE-2026-14257 openshift-service-mesh/kiali-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15194) * CVE-2026-14257 openshift-service-mesh/kiali-ossmc-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15220) * CVE-2026-73088 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15285) * CVE-2026-73088 openshift-service-mesh/kiali-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15286) * CVE-2026-73089 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15299) * CVE-2026-73089 openshift-service-mesh/kiali-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15300) * CVE-2026-41178 openshift-service-mesh/kiali-rhel9: OpenTelemetry-Go: Denial of Service via oversized baggage headers (OSSM-15339) * CVE-2026-67321 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15472) * CVE-2026-67321 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15473) * CVE-2026-67313 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15482) * CVE-2026-67313 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15483) * CVE-2026-67320 openshift-service-mesh/kiali-ossmc-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15491) * CVE-2026-67320 openshift-service-mesh/kiali-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15493) * CVE-2026-67314 openshift-service-mesh/kiali-ossmc-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15496) * CVE-2026-67314 openshift-service-mesh/kiali-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update includes the following RPMs: python3.14: * python3.14-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-debug-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-devel-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-freethreading-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-freethreading-debug-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-freethreading-devel-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-freethreading-idle-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-freethreading-libs-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-freethreading-test-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-freethreading-tkinter-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-idle-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-libs-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-test-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-tkinter-3.14.6-1.4.hum1 (aarch64, x86_64) * python3.14-3.14.6-1.4.hum1.src (src) Security Fix(es): python3.14: * CVE-2025-4330 * CVE-2026-11940