IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.5Alta

CVE-2026-44289protobufjs: Denial of service through unbounded protobuf recursion

protobufjs protobuf.js; Red Hat Red Hat Ansible Automation Platform 2.2; Red Hat Red Hat OpenShift AI 3.4; Red Hat OpenShift Pipelines Publicada: (hace 6 meses)

Descripción

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

Debilidad (CWE): CWE-674CWE-606

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
openshift ai 3.4 —
protobufjs protobuf.js < 7.5.6, >= 8.0.0, < 8.0.2
protobufjs project protobufjs < 7.5.6
Red Hat OpenShift Pipelines all versions
Red Hat OpenShift Service Mesh 3 —
Red Hat Red Hat Ansible Automation Platform 2 —
Red Hat Red Hat Ansible Automation Platform 2.2 all versions
Red Hat Red Hat Build of Podman Desktop —
Red Hat Red Hat Ceph Storage 9 all versions
Red Hat Red Hat Developer Hub —
Red Hat Red Hat Enterprise Linux 8 —
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 all versions
Red Hat Red Hat Hardened Images —
Red Hat Red Hat OpenShift AI 3.4 all versions
Red Hat Red Hat OpenShift AI (RHOAI) all versions
Red Hat Red Hat OpenShift Container Platform 4 —
Red Hat Red Hat Openshift Data Foundation 4 —

Referencias y parches

Coincidencias CPE (NVD) (2)
  • cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:* < 7.5.6
  • cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:* ≥ 8.0.0 < 8.0.2

CVE recientes del mismo producto — Red Hat Enterprise Linux

7.3Alta
CVE-2026-91151

Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it ca…

7.8Alta
CVE-2026-108472

Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in…

7.5Alta
CVE-2026-91150

Cockpit: cockpit: denial of service via unbounded fragmented websocket messages

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a…