Red Hat Security AdvisoryRHSA-2026:0722
multicluster engine for Kubernetes v2.8.4 security update
Released 2026-01-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9 +14
Fixes 9 records
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 72
Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00738 · Published 2025-08-20 · Partial fix · 2.4.12 CWE-20
Priority HIGH 72
Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0055 · Published 2025-08-20 · Partial fix · 1.0.5 CWE-20
Priority MEDIUM 48
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05994 · Published 2022-02-15 · Partial fix · 1.11.1 CWE-400
Priority MEDIUM 41
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01262 · Published 2024-03-05 · Partial fix · 1.33.0 CWE-835
Priority MEDIUM 40
golang-jwt is a Go implementation of JSON Web Tokens.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00811 · Published 2025-03-21 · Partial fix · 4.5.2, 5.2.2 CWE-405
Priority LOW 31
Cancelling a query (e.g.
CVSS 3.1HIGH 7.0· Network · No auth · No interaction · EPSS 0.00406 · Published 2025-08-07 · Partial fix · 1.23.12, 1.24.6 CWE-362
Priority LOW 28
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID.
CVSS 3.1MEDIUM 6.4· Local · High privileges · No interaction · EPSS 0.00243 · Published 2025-08-07 · Partial fix · 0.15.2, v4.17.39-2 +119 CWE-276
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00443 · Published 2025-10-29 · Partial fix · 1.24.8, 1.25.2
THREATIST.IORead the docs