Threats Tagged 'cve-2026-67320'

Red Hat OpenShift Logging 6.6.1 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.

CVE-2026-5079 is a denial of service vulnerability in Multer, a Node.js middleware used for handling multipart/form-data. An attacker can exploit this by sending a crafted HTTP request with deeply nested multipart form field names, causing excessive CPU and memory consumption. This leads to service unavailability in affected Red Hat products that use Multer. Red Hat Ansible Automation Platform versions including 2.1 and 2.2 are impacted. No official patch is currently available. Mitigation involves configuring the 'limits.fields' option in Multer to restrict the number of processed fields, which partially reduces the risk but does not fully prevent exploitation.

Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer Hub user experience that simplifies the automation experience for Ansible users of all skill levels. The Ansible plug-ins provide curated content and features to accelerate Ansible learner onboarding and streamline Ansible use case adoption across your organization.

Red Hat Quay 3.15.8 contains a Server-Side Request Forgery (SSRF) vulnerability in its repository-level mirror configuration feature. An authenticated repository administrator can exploit this flaw by providing a crafted hostname, causing the Quay mirror worker to make unauthorized requests to internal network services or cloud metadata endpoints. This could expose sensitive internal resources. The vulnerability requires administrator privileges and network egress restrictions or disabling the feature can mitigate the risk.

CVE-2026-67320 is a high severity vulnerability affecting Red Hat OpenShift Virtualization v4.12 images. It involves a Prototype Pollution flaw in the axios library when used in Node.js with the HTTP adapter. This flaw allows attackers to manipulate request interceptors to revert hardened request configurations, enabling them to route plaintext HTTP requests through a malicious proxy. This can lead to exposure of sensitive data such as authentication headers and request bodies, and potentially allow attackers to return malicious responses. Red Hat has acknowledged the issue but has not yet released a patch for affected versions.

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html-single/release_notes/index#acm-release-notes

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.14/html-single/release_notes/index#acm-release-notes

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html-single/release_notes/index#acm-release-notes

Kiali 2.27.3, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently. Security Fix(es): * CVE-2026-45623 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15115) * CVE-2026-45623 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15110) * CVE-2026-54272 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15124) * CVE-2026-54272 openshift-service-mesh/kiali-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15125) * CVE-2026-69153 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15160) * CVE-2026-69153 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15164) * CVE-2026-69152 openshift-service-mesh/kiali-ossmc-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15178) * CVE-2026-69152 openshift-service-mesh/kiali-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15179) * CVE-2026-69192 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15188) * CVE-2026-69192 openshift-service-mesh/kiali-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15189) * CVE-2026-14257 openshift-service-mesh/kiali-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15194) * CVE-2026-14257 openshift-service-mesh/kiali-ossmc-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15220) * CVE-2026-73088 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15285) * CVE-2026-73088 openshift-service-mesh/kiali-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15286) * CVE-2026-73089 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15299) * CVE-2026-73089 openshift-service-mesh/kiali-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15300) * CVE-2026-56852 openshift-service-mesh/kiali-rhel9: golang.org/x/text: Denial of Service via invalid UTF-8 input (OSSM-15325) * CVE-2026-56860 openshift-service-mesh/kiali-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15404) * CVE-2026-41178 openshift-service-mesh/kiali-rhel9: OpenTelemetry-Go: Denial of Service via oversized baggage headers (OSSM-15339) * CVE-2026-56859 openshift-service-mesh/kiali-rhel9: Go: Denial of Service via XML decoding recursion depth issue (OSSM-15409) * CVE-2026-56853 openshift-service-mesh/kiali-rhel9: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (OSSM-15423) * CVE-2026-56858 openshift-service-mesh/kiali-rhel9: Go html/template: Cross-Site Scripting via pathological input (OSSM-15437) * CVE-2026-56862 openshift-service-mesh/kiali-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15447) * CVE-2026-33818 openshift-service-mesh/kiali-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15457) * CVE-2026-67321 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15472) * CVE-2026-67321 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15473) * CVE-2026-67313 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15482) * CVE-2026-67313 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15483) * CVE-2026-67320 openshift-service-mesh/kiali-ossmc-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15491) * CVE-2026-67320 openshift-service-mesh/kiali-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15493) * CVE-2026-67314 openshift-service-mesh/kiali-ossmc-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15496) * CVE-2026-67314 openshift-service-mesh/kiali-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-67312 refers to multiple security issues fixed in the jupyter-nbdime-7.0.4-24.1 package distributed on openSUSE Tumbleweed. The vulnerabilities involve several CWEs including resource exhaustion and improper resource management. The Red Hat advisory references this CVE among others in a security update for hardened images RPMs. No direct exploit code or active exploitation is reported. The severity is assessed as medium based on the available information.