RHSA-2026:14774

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.

Axios is a promise based HTTP client for the browser and Node.js.

The net/url package does not set a limit on the number of query parameters in a query.

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content.

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters.

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.