Threats Tagged 'cve-2026-79921'

A security vulnerability (CVE-2026-49825) affecting the lxml HTML cleaner component used in Python environments has been identified and addressed by Red Hat. The issue involves a URL bypass vulnerability in the Cleaner due to a missing xlink:href attribute. This vulnerability affects multiple specific versions of Red Hat Quay and related Python lxml packages. Red Hat has issued an important security advisory with updated packages to remediate this issue.

Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

CVE-2026-79921 is a vulnerability in the amqp091-go client library used by RabbitMQ. A malicious AMQP broker can send content body frames larger than the negotiated frame_max limit, causing the client to allocate excessive memory. This bypasses the protocol's framing constraints and can lead to denial of service due to out-of-memory conditions.

A security update has been issued for Red Hat Hardened Images RPMs addressing a vulnerability in the opentelemetry-collector-contrib package identified as CVE-2026-79921. The update affects version 0.159.0-0.1.1.hum1 on aarch64 and x86_64 architectures. The advisory does not specify the nature of the vulnerability beyond its CWE classification (CWE-770). No explicit patch version is indicated as fixed, and no known exploits are reported in the wild.

Red Hat issued a security advisory for Multicluster Global Hub 1.8.2 addressing a high severity vulnerability identified as CVE-2026-17106. The affected component enables management of multiple hub clusters from a single hub cluster. The advisory also references updates to Red Hat Hardened Images RPMs including podman packages. No explicit CVSS score is provided. The update is available and includes fixes for this and other CVEs. The advisory provides package versions and instructions for applying the update.

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

VolSync v0.15 is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters. After deploying the VolSync operator, it can create and maintain copies of your persistent data. For more information about VolSync, see: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/business_continuity/business-cont-overview#volsync or the VolSync open source community website at: https://volsync.readthedocs.io/en/stable/.