Red Hat Security AdvisoryRHSA-2026:1517
RHACS 4.8.8 security and bug fix update
Released 2026-01-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
Fixes 10 records
Priority HIGH 69
In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input.
CVSS 3.1HIGH 7.8· Local · No auth · No interaction · EPSS 0.00152 · Published 2025-12-28 · Partial fix · 2.2.51, 2.4.9 CWE-675
Priority MEDIUM 50
jsPDF is a library to generate PDFs in JavaScript.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.02177 · Published 2026-01-05 · Fixed in 4.0.0 CWE-35
Priority MEDIUM 44
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00446 · Published 2025-11-26 · Partial fix · 1.3.2 CWE-674
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0058 · Published 2025-11-25 · Partial fix · 1.3.2 CWE-436
Priority LOW 39
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00475 · Published 2025-12-04 · Partial fix · 2.0.3 CWE-405
Priority LOW 38
React Router is a router for React.
CVSS 3.1HIGH 8.0· Network · No auth · User interaction · EPSS 0.00866 · Published 2026-01-10 · Partial fix · 7.12.0, 1.23.2 CWE-79
Priority LOW 38
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00226 · Published 2025-12-04 · Partial fix · 1.8.3 CWE-405
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0045 · Published 2025-12-29 · Partial fix · 6.14.1 CWE-20
Priority LOW 33
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0049 · Published 2025-12-02 · Partial fix · 1.24.11, 1.25.5 CWE-295
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00443 · Published 2025-10-29 · Partial fix · 1.24.8, 1.25.2
THREATIST.IORead the docs