Red Hat Vulnerabilities and Affected Products
Vulnerabilities associated with OpenShift Lightspeed.
Products
Clear product- Red Hat Enterprise Linux 91,515 vulnerabilities
- Red Hat Enterprise Linux 81,496 vulnerabilities
- Red Hat Enterprise Linux 71,145 vulnerabilities
- Red Hat Enterprise Linux 101,132 vulnerabilities
- Red Hat Enterprise Linux 61,113 vulnerabilities
- Red Hat OpenShift Container Platform 4430 vulnerabilities
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support402 vulnerabilities
- Red Hat Enterprise Linux 9.6 Extended Update Support386 vulnerabilities
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support377 vulnerabilities
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions367 vulnerabilities
- Red Hat Enterprise Linux 10.0 Extended Update Support361 vulnerabilities
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions356 vulnerabilities
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service353 vulnerabilities
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On325 vulnerabilities
- Red Hat Enterprise Linux 7 Extended Lifecycle Support319 vulnerabilities
- Red Hat OpenShift AI (RHOAI)302 vulnerabilities
- Red Hat Enterprise Linux 9.4 Extended Update Support297 vulnerabilities
- Red Hat Hardened Images277 vulnerabilities
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions270 vulnerabilities
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service253 vulnerabilities
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions253 vulnerabilities
- Red Hat JBoss Enterprise Application Platform Expansion Pack236 vulnerabilities
- Red Hat Enterprise Linux 8.2 Advanced Update Support213 vulnerabilities
- Red Hat Single Sign-On 7177 vulnerabilities
- Red Hat Fuse 7175 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-13676HIGH | fast-uri vulnerable to host confusion via failed IDN canonicalizationfast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo… | CVSS7.5v3.1 | EPSS0.384% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48746CRITICAL | vLLM: OpenAI auth bypassvLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0. | CVSS9.1v3.1 | EPSS1.15% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-54293HIGH | NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File ReadNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to by… CWE-22Jun 22, 2026 | CVSS7.5v3.1 | EPSS0.555% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48818HIGH | Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on WindowsStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas… CWE-918Jun 17, 2026 | CVSS7.5v3.1 | EPSS0.368% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48779HIGH | ws: Memory exhaustion DoS from tiny fragments and data chunksws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si… | CVSS7.5v3.1 | EPSS0.782% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-46625HIGH | JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionJavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.p… | CVSS7.5v3.1 | EPSS0.512% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-41567HIGH | Docker: `PUT /containers/{id}/archive` executes container binary on the hostMoby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary co… CWE-427Jun 5, 2026 | CVSS7.2v3.1 | EPSS0.161% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-5241CRITICAL | Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformersA vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `Lig… CWE-829Jun 3, 2026 | CVSS9.6v3.1 | EPSS0.547% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-27145HIGH | Inefficient candidate hostname parsing in crypto/x509(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates. | CVSS7.5v3.1 | EPSS0.591% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-34993MEDIUM | AIOHTTP Vulnerable to Deserialization of Untrusted DataAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading. CWE-502Jun 2, 2026 | CVSS6.4v3.1 | EPSS0.179% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-52011HIGH | launch-editor vulnerable to command injection via the crafted request on Windowslaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9. | CVSS7.5v4.0 | EPSS0.514% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-8643MEDIUM | pip can extract console_scripts and gui_scripts outside installation directorypip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory. CWE-22Jun 1, 2026 | CVSS4.1v4.0 | EPSS0.32% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-45292MEDIUM | opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagationopentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services th… CWE-770May 28, 2026 | CVSS5.3v3.1 | EPSS1.1% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48526HIGH | PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0. | CVSS7.4v3.1 | EPSS0.395% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48710MEDIUM | Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksStarlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) … | CVSS6.5v3.1 | EPSS1.84% | PoCs6 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2026-44209HIGH | Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTIBanks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt() are vulnerable to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE) on the host system. This vulnerability is fixed in 2.4.2. | CVSS7.5v3.1 | EPSS0.539% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-39821CRITICAL | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaThe ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to U… CWE-1289May 22, 2026 | CVSS9.6v3.1 | EPSS0.655% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-9277CRITICAL | shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is re… | CVSS9.2v4.0 | EPSS0.848% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-45736MEDIUM | ws: Uninitialized memory disclosurews is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1. | CVSS4.4v3.1 | EPSS0.745% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42561HIGH | Python-Multipart: Denial of Service via unbounded multipart part headersPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request reje… | CVSS7.5v3.1 | EPSS0.74% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-44432HIGH | urllib3: Decompression-bomb safeguards bypassed in parts of the streaming APIurllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly … CWE-409May 13, 2026 | CVSS8.9v4.0 | EPSS0.68% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-39820HIGH | Quadratic string concatentation in consumeComment in net/mailWell-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. | CVSS7.5v3.1 | EPSS0.784% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-33811HIGH | Crash when handling long CNAME response in netWhen using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. | CVSS7.5v3.1 | EPSS0.813% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42499HIGH | Quadratic string concatenation in consumePhrase in net/mailPathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. | CVSS7.5v3.1 | EPSS0.798% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-33814HIGH | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netWhen processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. | CVSS7.5v3.1 | EPSS0.781% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |