Threats Tagged 'cve-2026-25896'

Kiali 1.73.25, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently Security Fix(es): * kiali-ossmc-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031) * kiali-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031) * kiali-ossmc-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756) * kiali-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756)

See the release notes (link in the references section) for a description of the fixes and enhancements in this particular release.

Red Hat Developer Hub (RHDH) is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.

Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7342: RHODF 4.19.20 release DFBUGS-7332: [Backport for 4.19] - [GSS][ODF][MCG] noobaa-db-pg-cluster won't synchronize anymore - "could not receive data from WAL stream: ERROR: requested WAL segment 00000008000001C600000068 has already been removed" DFBUGS-6940: [4.19.z] Integrate ibm-storage-odf-operator 1.9.0 DFBUGS-6542: [ODF 4.19.z CLONE] - Provider Server sends sub channel to client only when provider side csv is at the tip of the sub channel in the catalogsource DFBUGS-6529: [Backport to 4.19.z] maintenance mode is always set for storageclients in non RDR clusters DFBUGS-6523: CLONE 4.19 - [UI] Resource profile calculations doesn't include NFS DFBUGS-4768: [Backport to odf-4.19.z]Remove duplicate PersistentVolumeUsageCritical alerts

An update is now available for Red Hat OpenShift GitOps. Bug Fix(es) and Enhancement(s): * GITOPS-8439 (CVE-2025-12816 openshift-gitops-1/console-plugin-rhel8: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications [gitops-1.18]) * GITOPS-8870 (CVE-2025-13465 openshift-gitops-1/argocd-rhel9: prototype pollution in _.unset and _.omit functions [gitops-1.18]) * GITOPS-8871 (CVE-2025-13465 openshift-gitops-1/console-plugin-rhel8: prototype pollution in _.unset and _.omit functions [gitops-1.18]) * GITOPS-8986 (CVE-2025-61726 openshift-gitops-1/argo-rollouts-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.18]) * GITOPS-8987 (CVE-2025-61726 openshift-gitops-1/argocd-agent-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.18]) * GITOPS-8988 (CVE-2025-61726 openshift-gitops-1/argocd-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.18]) * GITOPS-8989 (CVE-2025-61726 openshift-gitops-1/argocd-rhel9: Memory exhaustion in query parameter parsing in net/url [gitops-1.18]) * GITOPS-8990 (CVE-2025-61726 openshift-gitops-1/dex-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.18]) * GITOPS-8991 (CVE-2025-61726 openshift-gitops-1/gitops-rhel8: Memory exhaustion in query parameter parsing in net/url [gitops-1.18]) * GITOPS-8992 (CVE-2025-61726 openshift-gitops-1/gitops-rhel8-operator: Memory exhaustion in query parameter parsing in net/url [gitops-1.18]) * GITOPS-8324 (CVE-2025-66031 openshift-gitops-1/console-plugin-rhel8: node-forge ASN.1 Unbounded Recursion [gitops-1.17]) * GITOPS-8488 (CVE-2025-66418 openshift-gitops-1/console-plugin-rhel8: urllib3: Unbounded decompression chain leads to resource exhaustion [gitops-1.18]) * GITOPS-8489 (CVE-2025-66418 openshift-gitops-1/must-gather-rhel8: urllib3: Unbounded decompression chain leads to resource exhaustion [gitops-1.18]) * GITOPS-8643 (CVE-2025-66471 openshift-gitops-1/console-plugin-rhel8: urllib3 Streaming API improperly handles highly compressed data [gitops-1.18]) * GITOPS-9063 (CVE-2025-68121 openshift-gitops-1/dex-rhel8: Unexpected session resumption in crypto/tls [gitops-1.18]) * GITOPS-8684 (CVE-2026-21441 openshift-gitops-1/console-plugin-rhel8: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) [gitops-1.18])

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

Kiali 2.17.2, for Red Hat OpenShift Service Mesh 3.2, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently. Security Fix(es): * kiali-ossmc-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031) * kiali-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031) * kiali-ossmc-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756) * kiali-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756)