Threats Tagged 'cve-2026-73501'

rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fix(es): * golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability (CVE-2026-84961) was found in the undici BalancedPool component used in Red Hat Hardened Images RPMs, including grafana12.4 packages. The flaw allows a remote attacker to bypass TLS certificate validation when a custom certificate validation function is used, potentially enabling man-in-the-middle attacks. This affects undici versions 7.24.1 to 7.29.1 and 8.0.0 to 8.10.2. The issue is fixed in undici 7.29.1 and 8.10.2 and later. Applications not using BalancedPool or not using custom TLS validation are not affected. Red Hat has released updated RPMs to address this issue.

A vulnerability (CVE-2026-73501) was found in the kin-openapi component used in Red Hat Hardened Images RPMs, specifically in the grafana12.4 package. The flaw allows a remote attacker to bypass authentication checks due to improper handling of missing authentication configurations, enabling unauthorized access to protected resources. Red Hat rates this vulnerability as Important rather than Critical because exploitation requires specific middleware usage that is not enabled by default in affected images. Red Hat has released updated RPM packages addressing this issue. No known exploits are reported in the wild.

A vulnerability (CVE-2026-67214) was found in the nanoid JavaScript library used for generating unique identifiers. The flaw exists in the non-secure module where passing a negative size parameter to the customAlphabet or nanoid functions causes an infinite loop, resulting in a Denial of Service (DoS) by hanging the NodeJS event loop. This affects Red Hat Hardened Images RPMs including the jaeger package version 2.20.0-0.7.hum1. The issue is addressed by sanitizing inputs to ensure the size parameter is a non-negative integer. Red Hat has released an update including this fix. No known exploits are reported in the wild.

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.