IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key

cryostat vulnerabilities (CVE)

CVE records published for cryostat, newest first. Follow to get an email when a new one appears.

4 542 2Cryostat 1
56 results
8.1High
CVE-2026-54513

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

FasterXML jackson-databind; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only…

1.2%EPSS
7.5High
CVE-2026-50559

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

quarkusio quarkus; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1; Red Hat Red Hat build of Quarkus 3.20.6.SP2

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle ma…

1.0%EPSS
7.4High
CVE-2026-9697

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

undici undici; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert…

7.5High
CVE-2026-6734

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

undici undici; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless …

7.5High
CVE-2026-12151

undici WebSocket client vulnerable to denial of service via fragment count bypass

undici undici; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that ea…

7.5High
CVE-2026-48779

ws: Memory exhaustion DoS from tiny fragments and data chunks

websockets ws; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer c…

1.4%EPSS
7.5High
CVE-2026-12143

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

form-data form-data; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage …

7.5High
CVE-2026-50010

Netty's wrapping plain trust manager silently disables hostname verification

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X…

8.7High
CVE-2026-48059

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a synt…

5.3Medium
CVE-2026-48043

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a p…

8.7High
CVE-2026-47691

Netty has Insufficient Bailiwick Validation for NS Records

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1; Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An atta…

8.7High
CVE-2026-45674

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1; Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.…

7.5High
CVE-2026-45416

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the firs…

7.5High
CVE-2026-44893

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice…

8.1High
CVE-2026-44249

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.c…

7.5High
CVE-2026-46625

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

js-cookie js-cookie; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10; Red Hat Red Hat Ansible Automation Platform 2.1

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__pr…

8.7High
CVE-2026-46385

iskorotkov/avro: CPU Exhaustion in Avro Decoder

iskorotkov avro; Red Hat Cryostat 4 on RHEL 9; Red Hat Multicluster Global Hub 1.4.5; Red Hat Multicluster Global Hub 1.6.5

iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count …

8.7High
CVE-2026-46384

iskorotkov/avro: Integer Overflow in Avro Decoder

iskorotkov avro; Red Hat Cryostat 4 on RHEL 9; Red Hat Multicluster Global Hub 1.4.5; Red Hat Multicluster Global Hub 1.6.5

iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-i…

8.1High
CVE-2026-9277

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

shell-quote; Red Hat Cryostat 4 on RHEL 9; Red Hat Cluster Observability Operator 1.5.0; Red Hat Red Hat Ansible Automation Platform 2.1

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+202…

9.1Critical
CVE-2026-39830

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited glob…

7.5High
CVE-2026-39829

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by …

5.3Medium
CVE-2026-39835

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

6.3Medium
CVE-2026-39828

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat RHEM 1.0 for RHEL 9; Red Hat RHEM 1.1 for RHEL 10

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil…

4.4Medium
CVE-2026-45736

ws: Uninitialized memory disclosure

websockets ws; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.