Threats Tagged 'cve-2026-54399'

The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Security Fix(es): * Apache HttpComponents Core: Denial of Service via excessive HTTP headers (CVE-2026-54399) * Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks (CVE-2026-54428) * Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects (CVE-2026-15075) * Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation (CVE-2026-15076) * SeaweedFS: Information disclosure via S3 API gateway path traversal (CVE-2026-55874) * SeaweedFS: Unauthorized data deletion via path traversal in S3 gateway (CVE-2026-58372) * protobufjs: Denial of Service via crafted .proto schema (CVE-2026-59877) * Quarkus REST: Unbounded multipart MIME part-header accumulation allows remote OOM denial of service (CVE-2026-16308) * Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833) * Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831) * Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message (CVE-2026-55851) * Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec (CVE-2026-56745) * Netty: Security control bypass allows unauthorized requests via null origin header (CVE-2026-56746) * Netty: Denial of Service via HTTP/2 DATA frame memory leak (CVE-2026-56819) * Netty: Memory exhaustion in netty-codec-http (decompression bomb) (CVE-2026-59899) * Apache Thrift: Denial of Service via integer overflow or wraparound (CVE-2026-55969) * Apache Thrift: Denial of Service via improper handling of highly compressed data (CVE-2026-48586) * Apache Thrift: Denial of Service due to uncontrolled resource allocation (CVE-2026-45112) * brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVE-2026-69152) * ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) * jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494) * DOMPurify: Cross-site scripting vulnerability allows code execution (CVE-2026-49978) * OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * Go net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * Go encoding/xml: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) * Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * Go crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869) * golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions (CVE-2026-56854) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.30 release is based on Eclipse Che 7.121 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2. Users still using the v1 standard should migrate as soon as possible. https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates. https://access.redhat.com/support/policy/updates/openshift#crw

Spring Boot version 4.1.0-r0 addresses three security vulnerabilities, including CVE-2026-54399. The package update fixes these issues, improving the security posture of affected systems. No specific technical details or impact descriptions are provided for CVE-2026-54399. The vulnerability affects versions prior to 4.1.0-r0.

Spring Boot package versions prior to 4.0.7-r0 contain three vulnerabilities identified by CVE-2026-54399, CVE-2026-54428, and CVE-2026-64607. These vulnerabilities are addressed in version 4.0.7-r0. No CVSS score is provided for CVE-2026-54399, and there are no known exploits in the wild at this time.

Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat Streams for Apache Kafka 3.2.1 serves as a replacement for Red Hat Streams for Apache Kafka 3.2.0, and includes security and bug fixes, and enhancements. Security Fix(es): * golang-github-danielqsj-kafka_exporter: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests (CVE-2026-39852) * kafka-clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management (CVE-2026-35554) * log4j-layout-template-json: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output (CVE-2026-34481) * log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging (CVE-2026-34480) * log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames (CVE-2026-34478) * netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579) * netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584) * netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581) * netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578) * netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) * netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) * netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder (CVE-2026-42583) * netty-codec-compression: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder (CVE-2026-42583) * next: Next.js: Authorization bypass via crafted query parameters (CVE-2026-44574) * next: Next.js: Denial of Service via crafted POST requests to server actions (CVE-2026-44579) * next: Next.js: Denial of Service via Image Optimization API (CVE-2026-44577) * next: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n (CVE-2026-44573) * next: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests (CVE-2026-44578) * next: Next.js: Information disclosure via security fix bypass in middleware with Turbopack (CVE-2026-45109) * next: Next.js: Unauthorized access to protected content via middleware bypass (CVE-2026-44575) * quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters (CVE-2026-50559) * golang-github-danielqsj-kafka_exporter: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * vertx-core: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860) * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) * netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893) * netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043) * netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059) * netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) * golang-github-danielqsj-kafka_exporter: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * cluster-operator: Cross-namespace privilege escalation via Kafka.spec.entityOperator.watchedNamespace in Strimzi (CVE-2026-55225) * micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests (CVE-2026-40984) * micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests (CVE-2026-40983) * golang-github-danielqsj-kafka_exporter: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) * jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing (CVE-2026-50193) * golang-github-danielqsj-kafka_exporter: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * jacks

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

The OpenShift Compliance Operator v1.9.0 is now available. See the documentation for bug fix information: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/compliance-operator#compliance-operator-release-notes