RHSA-2026:36651

flatted is a circular JSON parser.

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

gRPC-Go is the Go language implementation of gRPC.

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

Immutable.js provides many Persistent Immutable data structures.

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint.

Prometheus is an open-source monitoring system and time series database.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`.

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.

Prometheus is an open-source monitoring system and time series database.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

React Router is a router for React.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.