Threats Tagged 'cve-2026-59874'

OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization v4.22 images.

Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.44. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:57401 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.

Kiali 2.22.8, for Red Hat OpenShift Service Mesh 3.3, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently. Security Fix(es): * CVE-2026-59873 openshift-service-mesh/kiali-rhel9: node-tar: Denial of Service via crafted gzip bomb (OSSM-14905) * CVE-2026-59873 openshift-service-mesh/kiali-ossmc-rhel9: node-tar: Denial of Service via crafted gzip bomb (OSSM-14908) * CVE-2026-59874 openshift-service-mesh/kiali-rhel9: Node-tar: Denial of Service via malformed tar archive header (OSSM-14909) * CVE-2026-59874 openshift-service-mesh/kiali-ossmc-rhel9: Node-tar: Denial of Service via malformed tar archive header (OSSM-14912) * CVE-2026-59869 openshift-service-mesh/kiali-rhel9: js-yaml: Denial of Service via crafted YAML documents (OSSM-14928) * CVE-2026-59869 openshift-service-mesh/kiali-ossmc-rhel9: js-yaml: Denial of Service via crafted YAML documents (OSSM-14930) * CVE-2026-49978 openshift-service-mesh/kiali-ossmc-rhel9: DOMPurify: Cross-site scripting vulnerability allows code execution (OSSM-15014) * CVE-2026-49978 openshift-service-mesh/kiali-rhel9: DOMPurify: Cross-site scripting vulnerability allows code execution (OSSM-15015) * CVE-2026-59877 openshift-service-mesh/kiali-ossmc-rhel9: protobufjs: Denial of Service via crafted .proto schema (OSSM-15027) * CVE-2026-59877 openshift-service-mesh/kiali-rhel9: protobufjs: Denial of Service via crafted .proto schema (OSSM-15028) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.22.7. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:44237 Security Fix(es): * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization (CVE-2026-13676) * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.