Red Hat Security Advisory

RHSA-2026:14937

A Subscription Management tool for finding and reporting Red Hat product usage

Released 2026-05-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9

Fixes 18 records

TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7

Server-side request forgery in axios

HIGH 82

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00711 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-183

TI-2026-30418 CVE-2026-42039 · GHSA-62hf-57xw-28j9

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

HIGH 70

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00772 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-674

TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

HIGH 68

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00403 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-113

TI-2026-30412 CVE-2026-42033 · GHSA-pf86-5x62-jrwf

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

HIGH 68

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00867 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-1321

TI-2025-38908 CVE-2025-62718 · GHSA-3p68-rc4w-qgx5

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

HIGH 67

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.01207 Published 2026-04-09 Partial fix · 1.15.0, 0.31.0 CWE-441

TI-2026-30420 CVE-2026-42041 · GHSA-w9j2-pvgh-6h63

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

MEDIUM 62

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00656 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-1321

TI-2026-28989 CVE-2026-40175 · GHSA-fvcv-3m26-pcqx

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

MEDIUM 57

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.01979 Published 2026-04-10 Partial fix · 1.15.0, 0.31.0 CWE-113

TI-2026-04471 CVE-2026-5121 · GHSA-2vwv-vqpv-v8vc

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

MEDIUM 51

A flaw was found in libarchive.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01092 Published 2026-03-30 Partial fix · 3.1.2-14.el7_9.2, 3.3.3-7.el8_10 +51 CWE-190

TI-2026-03838 CVE-2026-4424 · GHSA-c75f-55f6-f63q

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

MEDIUM 41

A flaw was found in libarchive.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01287 Published 2026-03-19 Partial fix · 3.7.7-8.el10_1, 3.7.7-5.el10_0 +54 CWE-125

TI-2026-22665 CVE-2026-28390 · GHSA-fgpp-q3px-3xhc

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

MEDIUM 40

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00836 Published 2026-04-07 Partial fix · 3.6.2, 3.5.6 +5 CWE-476

TI-2026-21585 CVE-2026-27135

nghttp2 Denial of service: Assertion failure due to the missing state validation

MEDIUM 40

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00823 Published 2026-03-18 Fixed in 1.68.1 CWE-617

TI-2026-27521 CVE-2026-35385 · GHSA-jgqr-738j-43cg

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an…

LOW 38

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (pres…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00573 Published 2026-04-02 Partial fix · 10.3 CWE-281

TI-2026-27522 CVE-2026-35386 · GHSA-v93f-5rx7-jm73

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a…

LOW 37

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00324 Published 2026-04-02 Partial fix · 10.3 CWE-696

TI-2026-27550 CVE-2026-35414 · GHSA-f6c7-fj8h-5898

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon…

LOW 35

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00218 Published 2026-04-02 Partial fix · 10.3 CWE-670

TI-2026-04252 CVE-2026-4878

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

LOW 32

A flaw was found in libcap.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00209 Published 2026-04-09 Partial fix · 2.69-7.el10_1.1, 2.69-7.el10_2.1 +51 CWE-367

TI-2026-29551 CVE-2026-40895

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

LOW 31

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00486 Published 2026-04-21 Partial fix · 1.16.0 CWE-200

TI-2026-27523 CVE-2026-35387 · GHSA-hpxh-vgmp-3qp6

OpenSSH before 10.3 can use unintended ECDSA algorithms.

LOW 28

OpenSSH before 10.3 can use unintended ECDSA algorithms.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00241 Published 2026-04-02 Partial fix · 10.3 CWE-670

TI-2026-27524 CVE-2026-35388 · GHSA-9fjj-jvxf-738c

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

LOW 12

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

CVSS 3.1LOW 2.5 Local No auth User interaction EPSS 0.00132 Published 2026-04-02 Partial fix · 10.3 CWE-420