Most recent entries from csaf_redhat

RHSA-2026:74581 — Red Hat Security Advisory: skopeo security update

2026-10-02T05:31:26+00:00

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

RHSA-2026:74023 — Red Hat Security Advisory: OpenShift Container Platform 4.21 CNF IBU extras update

2026-10-02T05:31:26+00:00

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters

RHSA-2026:73987 — Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI

2026-10-02T05:31:25+00:00

golang: net/url: Memory exhaustion in query parameter parsing in net/url urllib3: urllib3 Streaming API improperly handles highly compressed data nltk: NLTK: Arbitrary Code Execution via Eval Injection in Collocations Module undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: undici: Denial of Service via crafted WebSocket frame with large length undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy keras: Keras: Arbitrary file write via path traversal in archive extraction utilities sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity guardrails-detectors: guardrails-detectors: Unauthenticated Regular-Expression…

RHSA-2026:73518 — Red Hat Security Advisory: OpenShift Container Platform 4.16 CNF vRAN extras topology aware lifecycle manager update

2026-10-02T05:31:24+00:00

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

RHSA-2026:73508 — Red Hat Security Advisory: OpenShift Container Platform 4.21 CNF vRAN extras topology aware lifecycle manager update

2026-10-02T05:31:24+00:00

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

RHSA-2026:73085 — Red Hat Security Advisory: OpenShift Container Platform 4.22 CNF vRAN extras topology aware lifecycle manager update

2026-10-02T05:31:23+00:00

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

RHSA-2026:72508 — Red Hat Security Advisory: OpenShift Container Platform 4.20 CNF IBU extras update

2026-10-02T05:31:22+00:00

RHSA-2026:71455 — Red Hat Security Advisory: OpenShift Container Platform 4.21.35 security and extras update

2026-10-02T05:31:21+00:00

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

RHSA-2026:71454 — Red Hat Security Advisory: OpenShift Container Platform 4.22.16 bug fix and security update

2026-10-02T05:31:19+00:00

fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs openshift/console: openshift/console: Unauthenticated SSRF and resource exhaustion via devfile parser endpoint openshift/console: openshift/console: Unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler

RHSA-2026:71453 — Red Hat Security Advisory: OpenShift Container Platform 4.21.35 bug fix and security update

2026-10-02T05:31:19+00:00

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs openshift/console: openshift/console: Unauthenticated SSRF and resource exhaustion via devfile parser endpoint openshift/console: openshift/console: Unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler qs: qs: Denial of Service via improper validation in stringify function