IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen

openshift devspaces Schwachstellen (CVE)

Für openshift devspaces veröffentlichte CVE-Einträge, neueste zuerst. Folgen Sie, um bei neuen Einträgen eine E-Mail zu erhalten.

3.29 333.28 323.27 303.30 193.26 53.31 23.24 23.22 13.23 1
113 Ergebnisse
6.8Mittel
CVE-2026-114406

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certif…

7.5Hoch
CVE-2026-87743

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Red Hat Red Hat build of Quarkus 3.27.5.SP2; Red Hat Red Hat build of Quarkus 3.33.3.SP2; Red Hat Red Hat OpenShift Dev Spaces 3.31; Red Hat Exploit Intelligence

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers…

7.5Hoch
CVE-2026-13676

fast-uri vulnerable to host confusion via failed IDN canonicalization

fast-uri fast-uri; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Enterprise Linux 10

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form…

8.1Hoch
CVE-2026-54513

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

FasterXML jackson-databind; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only…

1.2%EPSS
7.8Hoch
CVE-2026-48020

Traefik StripPrefix Route-Level Auth Bypass via Path Normalization

traefik traefik; Red Hat Red Hat OpenShift Dev Spaces 3.30

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization.…

7.5Hoch
CVE-2026-50559

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

quarkusio quarkus; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1; Red Hat Red Hat build of Quarkus 3.20.6.SP2

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle ma…

1.0%EPSS
7.4Hoch
CVE-2026-9697

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

undici undici; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert…

7.5Hoch
CVE-2026-6734

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

undici undici; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless …

7.5Hoch
CVE-2026-12151

undici WebSocket client vulnerable to denial of service via fragment count bypass

undici undici; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that ea…

7.5Hoch
CVE-2026-48779

ws: Memory exhaustion DoS from tiny fragments and data chunks

websockets ws; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer c…

1.4%EPSS
9.3Kritisch
CVE-2026-44990

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

apostrophecms sanitize-html; Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a …

7.5Hoch
CVE-2026-12143

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

form-data form-data; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage …

7.5Hoch
CVE-2026-50010

Netty's wrapping plain trust manager silently disables hostname verification

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X…

8.7Hoch
CVE-2026-48059

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a synt…

5.3Mittel
CVE-2026-48043

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a p…

8.7Hoch
CVE-2026-47691

Netty has Insufficient Bailiwick Validation for NS Records

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1; Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An atta…

8.7Hoch
CVE-2026-45674

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1; Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.…

7.5Hoch
CVE-2026-45416

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the firs…

7.5Hoch
CVE-2026-44893

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice…

8.1Hoch
CVE-2026-44249

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.c…

7.5Hoch
CVE-2026-44486

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may ad…

8.2Hoch
CVE-2026-44487

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usa…