Threats Tagged 'cve-2026-44990'

Submariner is a Kubernetes operator that enables cross-cluster connectivity for services and pods, implementing KEP-1645 (Multi-Cluster Services API). After deploying the Submariner operator, it can enable direct networking between pods and services across different Kubernetes clusters. For more information about Submariner, see the Submariner open source community website at: https://submariner.io/.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.45. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:60452 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.17/html-single/release_notes/index#acm-release-notes

The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.20.32. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2026:48673 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Security Fix(es): * netty-handler: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) * netty-resolver-dns: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) * netty-handler: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) * io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059) * netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043) * netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893) * netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) * io.quarkus/quarkus-vertx-http: Authorization bypass in HTTP path-based policies via encoded characters (CVE-2026-50559) * jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) * jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860) * golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595) * golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828) * golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) * golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: Cross-Site Scripting allowing arbitrary code execution (CVE-2026-25681) * golang.org/x/image/tiff: Denial of Service via crafted PackBits-compressed data (CVE-2026-46599) * github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder (CVE-2026-46384) * github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration (CVE-2026-46385) * net: golang: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * mime: golang: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * form-data: Form field override via CRLF injection (CVE-2026-12143) * ws: Denial of Service via memory exhaustion from small WebSocket fragments (CVE-2026-48779) * ws: Uninitialized memory disclosure via websocket.close() with TypedArray (CVE-2026-45736) * undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * js-cookie: Cookie attribute manipulation via prototype pollution (CVE-2026-46625) * brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * protobufjs: Denial of Service via crafted schema (CVE-2026-44290) * protobufjs: Data integrity impact due to prototype pollution (CVE-2026-44292) * protobufjs: Denial of Service via crafted JSON descriptors (CVE-2026-45740) * protobufjs: Arbitrary Code Execution via prototype pollution (CVE-2026-44291) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Security Fix(es): * netty-handler: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) * netty-resolver-dns: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) * netty-handler: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) * io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059) * netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043) * netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893) * netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) * io.quarkus/quarkus-vertx-http: Authorization bypass in HTTP path-based policies via encoded characters (CVE-2026-50559) * jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) * jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860) * golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595) * golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828) * golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) * golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: Cross-Site Scripting allowing arbitrary code execution (CVE-2026-25681) * golang.org/x/image/tiff: Denial of Service via crafted PackBits-compressed data (CVE-2026-46599) * github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder (CVE-2026-46384) * github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration (CVE-2026-46385) * net: golang: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * mime: golang: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * form-data: Form field override via CRLF injection (CVE-2026-12143) * ws: Denial of Service via memory exhaustion from small WebSocket fragments (CVE-2026-48779) * ws: Uninitialized memory disclosure via websocket.close() with TypedArray (CVE-2026-45736) * undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * js-cookie: Cookie attribute manipulation via prototype pollution (CVE-2026-46625) * brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * protobufjs: Denial of Service via crafted schema (CVE-2026-44290) * protobufjs: Data integrity impact due to prototype pollution (CVE-2026-44292) * protobufjs: Denial of Service via crafted JSON descriptors (CVE-2026-45740) * protobufjs: Arbitrary Code Execution via prototype pollution (CVE-2026-44291) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Quay 3.12.20

Red Hat Advanced Cluster Management for Kubernetes 2.11 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html-single/release_notes/index#acm-release-notes

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.5. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2026:37583 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/