IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API

Vulnerabilidades de redhat OpenShift Serverless (CVE)

Registros CVE publicados para redhat OpenShift Serverless, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

42 resultados
8.8Alta
CVE-2026-50240

Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount

pipelines-as-code; Red Hat Builds for Red Hat OpenShift; Red Hat OpenShift Pipelines; Red Hat OpenShift Serverless

A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to e…

7.7Alta
CVE-2026-107912

Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw

Red Hat Exploit Intelligence; Red Hat OpenShift Serverless; Red Hat Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat Red Hat build of Apicurio Registry 3

A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situati…

6.4Media
CVE-2026-107174

Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction

source-to-image; Red Hat OpenShift Serverless; Red Hat OpenShift Source-to-Image (S2I); Red Hat Red Hat OpenShift Container Platform 4

A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links …

7.5Alta
CVE-2026-87743

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Red Hat Red Hat build of Quarkus 3.27.5.SP2; Red Hat Red Hat build of Quarkus 3.33.3.SP2; Red Hat Red Hat OpenShift Dev Spaces 3.31; Red Hat Exploit Intelligence

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers…

8.1Alta
CVE-2026-54513

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

FasterXML jackson-databind; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only…

1.2%EPSS
7.5Alta
CVE-2026-50559

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

quarkusio quarkus; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1; Red Hat Red Hat build of Quarkus 3.20.6.SP2

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle ma…

1.0%EPSS
8.7Alta
CVE-2026-48059

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a synt…

5.3Media
CVE-2026-48043

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a p…

7.5Alta
CVE-2026-44893

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice…

5.3Media
CVE-2026-45292

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

open-telemetry opentelemetry-java; io.opentelemetry opentelemetry-api; io.opentelemetry opentelemetry-extension-trace-propagators; Red Hat Red Hat Data Grid 8.6.2

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opente…

1.1%EPSS
9.8Crítica
CVE-2026-47323

Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering

Apache Software Foundation Apache Camel; Red Hat OpenShift Serverless; Red Hat Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat Red Hat build of Apache Camel for Spring Boot 4

Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFil…

20%EPSS
7.5Alta
CVE-2026-42579

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16; Red Hat Red Hat build of Quarkus 3.27.4

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface:…

1.0%EPSS
8.8Alta
CVE-2026-39852

Quarkus authorization bypass via semicolon path normalization inconsistency

quarkusio quarkus; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27

Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or …

8.2Alta
CVE-2026-40022

Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime

Apache Software Foundation Apache Camel Platform HTTP Main; Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14; Red Hat OpenShift Serverless; Red Hat Red Hat build of Apache Camel 4 for Quarkus 3

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenti…

9.9Crítica
CVE-2026-40453

Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

Apache Software Foundation Apache Camel JMS; Apache Software Foundation Apache Camel CoAP; Apache Software Foundation Apache Camel Google PubSub; Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to…

2.1%EPSS
7.3Alta
CVE-2026-40542

Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

Apache Software Foundation Apache HttpClient; Red Hat OpenShift Developer Tools and Services 4.12; Red Hat OpenShift Developer Tools and Services 4.13; Red Hat OpenShift Developer Tools and Services 4.14

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes th…

7.5Alta
CVE-2026-40938

Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

tektoncd pipeline; Red Hat Red Hat OpenShift Builds 1.7.3; Red Hat Red Hat OpenShift Builds 1.8.1; Red Hat Red Hat OpenShift Pipelines 1.21

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argumen…

9.1Crítica
CVE-2026-33557

Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

Apache Software Foundation Apache Kafka; Red Hat OpenShift Serverless; Red Hat Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat Red Hat build of Apache Camel for Spring Boot 4

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without valid…

7.6Alta
CVE-2026-34742

Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost

modelcontextprotocol go-sdk; Red Hat Red Hat OpenShift Dev Spaces 3.28; Red Hat Migration Toolkit for Virtualization; Red Hat OpenShift Lightspeed

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authenticati…

8.7Alta
CVE-2026-33871

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.12.7; Red Hat Red Hat AMQ Broker 7.13.5

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The serve…

1.3%EPSS
7.5Alta
CVE-2026-33870

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.12.7; Red Hat Red Hat AMQ Broker 7.13.5

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Vers…

9.6Crítica
CVE-2026-33211

Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

tektoncd pipeline; Red Hat Builds for Red Hat OpenShift 1.6.0; Red Hat Red Hat OpenShift Builds 1.7.3; Red Hat Red Hat OpenShift Pipelines 1.2

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathI…

8.7Alta
CVE-2026-31837

Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.

istio istio; Red Hat Red Hat OpenShift AI 2.25; Red Hat Red Hat OpenShift Service Mesh 3.0; Red Hat Red Hat OpenShift Service Mesh 3.1

Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestA…

7.0Alta
CVE-2025-15558

Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Docker Docker CLI; Docker Compose; Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2; Red Hat Builds for Red Hat OpenShift

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-build…