RHSA-2026:19375

Axios is a promise based HTTP client for the browser and Node.js.

Authlib is a Python library which builds OAuth and OpenID Connect servers.

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js.

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an at…

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verificati…

Axios is a promise based HTTP client for the browser and Node.js.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

PyJWT is a JSON Web Token implementation in Python.

The DataRow.Decode function fails to properly validate field lengths.

pyasn1 is a generic ASN.1 library for Python.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

gRPC-Go is the Go language implementation of gRPC.

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1…

Immutable.js provides many Persistent Immutable data structures.

Pillow is a Python imaging library.

The net/url package does not set a limit on the number of query parameters in a query.

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation.

A flaw was found in Red Hat Quay's handling of resumable container image layer uploads.

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.

Authlib is a Python library which builds OAuth and OpenID Connect servers.

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applie…

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

pyOpenSSL is a Python wrapper around the OpenSSL library.

A flaw was found in Red Hat Quay's container image upload process.

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.

A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift.