Threats Tagged 'cve-2026-21723'

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana13.1 package to version 13.1.3-0.5.hum1. This update addresses multiple security vulnerabilities identified by several CVEs including CVE-2026-8595. The advisory covers both aarch64 and x86_64 architectures. The update is a bug fix and enhancement release.

CVE-2026-1229 is a low-severity vulnerability in the Cloudflare CIRCL library affecting the CombinedMult function in the ecc/p384 package for the secp384r1 curve. The function produces incorrect values for certain inputs due to incomplete addition formulas. This issue does not affect ECDH or ECDSA operations relying on this curve. The vulnerability was fixed in version 1.6.3 of CIRCL.

A vulnerability in the Node.js qs library causes qs.stringify to throw a TypeError when serializing an object whose own constructor property has a truthy, non-callable isBuffer member. Red Hat has issued an advisory for Red Hat Hardened Images RPMs, including an update to the grafana13.2 package, addressing this and other vulnerabilities. The update is available and should be applied to affected systems. No active exploitation has been reported.

The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.