THREATIST.IORead the docs Migration Toolkit for Containers (MTC) 1.8.7 security and bug fix update
Released 2025-06-04 · Red Hat rating Important · View on Red Hat →
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization.
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch.
golang-jwt is a Go implementation of JSON Web Tokens.
An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.