Threats Tagged 'cve-2026-40890'

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Security Fix(es): * DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization (CVE-2026-41240) * crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * shell-quote: Arbitrary code execution via command injection due to unescaped line terminators (CVE-2026-9277) * Apache Thrift: Security bypass due to improper certificate validation (CVE-2026-43869) * Netty: High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579) * Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584) * Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581) * Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578) * Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) * Apache Thrift c_glib: Denial of Service via specially crafted requests (CVE-2025-48431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.