Threats Tagged 'cve-2026-33036'

An update is now available for Red Hat OpenShift GitOps.

Quay 3.12.18

Network flows collector and monitoring solution.

Red Hat OpenShift Data Foundation 4.16.26 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-6193: Backport to odf-4.16.26 ocs-operator should not use image gcr.io/kubebuilder/kube-rbac-proxy DFBUGS-5940: Backport to odf-4.16.z [External Mode]: noobaa-default-backing-store is in creating state due to "CheckExternalConnection Status=UNKNOWN_FAILURE Error=SELF_SIGNED_CERT_IN_CHAIN"

Red Hat Advanced Cluster Security for Kubernetes (RHACS) version 4.9.7 includes important security and bug fixes addressing multiple vulnerabilities, including CVE-2025-62718 and several others. The update resolves issues such as inconsistent CVE severity reporting and multiple security flaws identified in the product. Users of earlier RHACS versions are advised to upgrade to 4.9.7 to benefit from these fixes and enhancements.

Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale. Data Grid 8.6.1 replaces Data Grid 8.6.0 and includes bug fixes and enhancements. Find out more about Data Grid 8.6.1 in the Release Notes[3]. Security Fix(es): * CVE-2026-33871 netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood [jdg-8] (CVE-2026-33871) * CVE-2026-33870 netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values [jdg-8] (CVE-2026-33870) * CVE-2026-42043 axios: Axios: NO_PROXY bypass via crafted URL [jdg-8] (CVE-2026-42043) * CVE-2026-42041 axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling [jdg-8.6] (CVE-2026-42041) * CVE-2026-42039 axios: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data [jdg-8.6] (CVE-2026-42039) * CVE-2026-42033 axios: Axios: HTTP Transport Hijacking via Prototype Pollution [jdg-8.6] (CVE-2026-42033) * CVE-2026-40975 spring-boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. [jdg-8.6] (CVE-2026-40975) * CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports [jdg-8.6] (CVE-2026-4800) * CVE-2026-41240 dompurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization [jdg-8.6] (CVE-2026-41240) * CVE-2026-34481 log4j-layout-template-json: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output [jdg-8.6] (CVE-2026-34481) * CVE-2026-34480 log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging [jdg-8.6] (CVE-2026-34480) * CVE-2026-34478 log4j-core-test: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames [jdg-8.6] (CVE-2026-34478) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Data Foundation 4.18.20 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-6235: [4.18] [ROSA HCP][UI blocker] Broken Storage System wizard DFBUGS-6185: ocs-operator should not use image gcr.io/kubebuilder/kube-rbac-proxy DFBUGS-6172: RHODF 4.18.20 DFBUGS-5939: Backport to odf-4.18.z [External Mode]: noobaa-default-backing-store is in creating state due to "CheckExternalConnection Status=UNKNOWN_FAILURE Error=SELF_SIGNED_CERT_IN_CHAIN"

Red Hat OpenShift Data Foundation 4.17.24 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-6194: Backport to odf-4.17.24 ocs-operator should not use image gcr.io/kubebuilder/kube-rbac-proxy DFBUGS-5943: Backport to odf-4.17.z [External Mode]: noobaa-default-backing-store is in creating state due to "CheckExternalConnection Status=UNKNOWN_FAILURE Error=SELF_SIGNED_CERT_IN_CHAIN"

Red Hat OpenShift Data Foundation 4.19.15 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-6345: RHODF 4.19.15 DFBUGS-5942: Backport to odf-4.19.z [External Mode]: noobaa-default-backing-store is in creating state due to "CheckExternalConnection Status=UNKNOWN_FAILURE Error=SELF_SIGNED_CERT_IN_CHAIN" DFBUGS-5819: [Backport to odf-4.19.z] [IBM_Support][Fusion HCI]"storageclient-xxxxx-status-reporter job" doesn't inherits the tolerations defined in "ocs-client-operator-controller-manager" deployment DFBUGS-5800: [Backport to odf-4.19.z] must-gather causes default RGW pools to be created and PGs to be stuck at 1 DFBUGS-4440: [4.19][ROSA HCP][UI]Bad gateway on Storage System creation wizard CVEs: ========== CVE-2026-34986 CVE-2025-61726 CVE-2026-33186 CVE-2025-61729 CVE-2026-4800 CVE-2025-58183 CVE-2026-33036

An update is now available for Red Hat OpenShift GitOps. Bug Fix(es) and Enhancement(s): * GITOPS-8784 (Service-CA annotation removed from argocd-server Service during v1.12.3 -> v1.12.4 upgrade path, persists in later versions)