Red Hat Security AdvisoryRHSA-2026:15091
OpenShift Container Platform 4.14.65 bug fix and security update
Released 2026-05-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
Fixes 8 records
Priority HIGH 72
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00539 · Published 2026-02-11 · Partial fix · 6.14.0, 8.17.2 +1 CWE-1333
Priority MEDIUM 57
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1MEDIUM 4.8· Network · No auth · No interaction · EPSS 0.01979 · Published 2026-04-10 · Partial fix · 1.15.0, 0.31.0 CWE-113
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02292 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00827 · Published 2026-03-06 · Partial fix · 1.25.8, 1.26.1 CWE-425
Priority MEDIUM 40
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
CVSS 3.1HIGH 8.6· Local · No auth · User interaction · EPSS 0.00531 · Published 2026-02-05 · Partial fix · 1.24.13, 1.25.7 CWE-94
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01823 · Published 2026-01-21 · Partial fix · 4.17.23, 4.18.0 CWE-1321
Priority LOW 37
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0061 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6
Priority LOW 30
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00738 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
THREATIST.IORead the docs