Threats Tagged 'cve-2026-67321'

Red Hat OpenShift Logging 6.6.1 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.

CVE-2026-5079 is a denial of service vulnerability in Multer, a Node.js middleware used for handling multipart/form-data. An attacker can exploit this by sending a crafted HTTP request with deeply nested multipart form field names, causing excessive CPU and memory consumption. This leads to service unavailability in affected Red Hat products that use Multer. Red Hat Ansible Automation Platform versions including 2.1 and 2.2 are impacted. No official patch is currently available. Mitigation involves configuring the 'limits.fields' option in Multer to restrict the number of processed fields, which partially reduces the risk but does not fully prevent exploitation.

Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer Hub user experience that simplifies the automation experience for Ansible users of all skill levels. The Ansible plug-ins provide curated content and features to accelerate Ansible learner onboarding and streamline Ansible use case adoption across your organization.

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html-single/release_notes/index#acm-release-notes

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.14/html-single/release_notes/index#acm-release-notes

Kiali 2.27.3, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently. Security Fix(es): * CVE-2026-45623 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15115) * CVE-2026-45623 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15110) * CVE-2026-54272 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15124) * CVE-2026-54272 openshift-service-mesh/kiali-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15125) * CVE-2026-69153 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15160) * CVE-2026-69153 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15164) * CVE-2026-69152 openshift-service-mesh/kiali-ossmc-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15178) * CVE-2026-69152 openshift-service-mesh/kiali-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15179) * CVE-2026-69192 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15188) * CVE-2026-69192 openshift-service-mesh/kiali-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15189) * CVE-2026-14257 openshift-service-mesh/kiali-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15194) * CVE-2026-14257 openshift-service-mesh/kiali-ossmc-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15220) * CVE-2026-73088 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15285) * CVE-2026-73088 openshift-service-mesh/kiali-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15286) * CVE-2026-73089 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15299) * CVE-2026-73089 openshift-service-mesh/kiali-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15300) * CVE-2026-56852 openshift-service-mesh/kiali-rhel9: golang.org/x/text: Denial of Service via invalid UTF-8 input (OSSM-15325) * CVE-2026-56860 openshift-service-mesh/kiali-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15404) * CVE-2026-41178 openshift-service-mesh/kiali-rhel9: OpenTelemetry-Go: Denial of Service via oversized baggage headers (OSSM-15339) * CVE-2026-56859 openshift-service-mesh/kiali-rhel9: Go: Denial of Service via XML decoding recursion depth issue (OSSM-15409) * CVE-2026-56853 openshift-service-mesh/kiali-rhel9: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (OSSM-15423) * CVE-2026-56858 openshift-service-mesh/kiali-rhel9: Go html/template: Cross-Site Scripting via pathological input (OSSM-15437) * CVE-2026-56862 openshift-service-mesh/kiali-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15447) * CVE-2026-33818 openshift-service-mesh/kiali-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15457) * CVE-2026-67321 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15472) * CVE-2026-67321 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15473) * CVE-2026-67313 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15482) * CVE-2026-67313 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15483) * CVE-2026-67320 openshift-service-mesh/kiali-ossmc-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15491) * CVE-2026-67320 openshift-service-mesh/kiali-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15493) * CVE-2026-67314 openshift-service-mesh/kiali-ossmc-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15496) * CVE-2026-67314 openshift-service-mesh/kiali-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-67312 refers to multiple security issues fixed in the jupyter-nbdime-7.0.4-24.1 package distributed on openSUSE Tumbleweed. The vulnerabilities involve several CWEs including resource exhaustion and improper resource management. The Red Hat advisory references this CVE among others in a security update for hardened images RPMs. No direct exploit code or active exploitation is reported. The severity is assessed as medium based on the available information.

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

This update for python-joserfc fixes the following issues: Changes in python-joserfc: - CVE-2026-62995: acceptance of JWTs with trailing padding can lead to JWT malleability and allows for bypass of token revocation and anti-replay protection (bsc#1272991)

This update includes the following RPMs: jaeger: * jaeger-2.20.0-0.8.hum1 (aarch64, x86_64) * jaeger-2.20.0-0.8.hum1.src (src) Security Fix(es): jaeger: * CVE-2026-62995