IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API

Vulnerabilidades de advanced cluster security (CVE)

Registros CVE publicados para advanced cluster security, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

4.9 494.10 404.8 214.11 113.74 44.1 44.2 44.4 24.5 2
60 resultados
6.8Media
CVE-2026-114406

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certif…

7.4Alta
CVE-2026-103314

Stackrox: stackrox: saml response replay allows multiple central authentication tokens

Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10; Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.11

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML re…

7.7Alta
CVE-2026-9165

Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service

Red Hat Red Hat Advanced Cluster Security 4.9; Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10; Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.11; Red Hat Red Hat Advanced Cluster Security 4

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause e…

7.5Alta
CVE-2026-12143

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

form-data form-data; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage …

7.5Alta
CVE-2026-44486

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may ad…

8.2Alta
CVE-2026-44487

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usa…

7.5Alta
CVE-2026-44488

Axios: Allocation of Resources Without Limits or Throttling in axios

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or r…

7.5Alta
CVE-2026-44496

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard…

5.4%EPSS
7.0Alta
CVE-2026-44495

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Ob…

8.7Alta
CVE-2026-44494

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escal…

1.1%EPSS
8.6Alta
CVE-2026-44492

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IP…

12%EPSS
7.5Alta
CVE-2026-46625

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

js-cookie js-cookie; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10; Red Hat Red Hat Ansible Automation Platform 2.1

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__pr…

9.6Crítica
CVE-2026-39821

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/idna; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

1.8%EPSS
9.1Crítica
CVE-2026-42508

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

6.9%EPSS
9.1Crítica
CVE-2026-39830

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited glob…

7.5Alta
CVE-2026-39829

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by …

5.3Media
CVE-2026-39835

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

9.1Crítica
CVE-2026-39832

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

golang.org/x/crypto golang.org/x/crypto/ssh/agent; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote…

6.3Media
CVE-2026-39828

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat RHEM 1.0 for RHEL 9; Red Hat RHEM 1.1 for RHEL 10

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil…

7.4Alta
CVE-2026-42264

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Data Grid 8.6.2

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access …

7.5Alta
CVE-2026-39820

Quadratic string concatentation in consumeComment in net/mail

Go standard library net/mail; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

7.5Alta
CVE-2026-33811

Crash when handling long CNAME response in net

Go standard library net; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

7.5Alta
CVE-2026-42499

Quadratic string concatenation in consumePhrase in net/mail

Go standard library net/mail; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

6.9Media
CVE-2026-42039

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

axios axios; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Data Grid 8.6.1; Red Hat multicluster engine for Kubernetes 2.1

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This …