Red Hat Security AdvisoryRHSA-2026:26420
Red Hat OpenShift Data Foundation 4.18.24 security, enhancement & bug fix update
Released 2026-06-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
Fixes 7 records
Priority HIGH 72
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00612 · Published 2026-01-30 · Partial fix · 5.3.4 CWE-20
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01619 · Published 2026-03-20 · Partial fix · 1.79.3 CWE-285
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02292 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
Priority MEDIUM 40
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00634 · Published 2026-05-04 · Partial fix · 3.1.1, 2.4.1 CWE-22
Priority LOW 38
React Router is a router for React.
CVSS 3.1HIGH 8.0· Network · No auth · User interaction · EPSS 0.00866 · Published 2026-01-10 · Partial fix · 7.12.0, 1.23.2 CWE-79
Priority LOW 33
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0049 · Published 2025-12-02 · Partial fix · 1.24.11, 1.25.5 CWE-295
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00443 · Published 2025-10-29 · Partial fix · 1.24.8, 1.25.2
THREATIST.IORead the docs