Red Hat Security AdvisoryRHSA-2026:37186
OpenShift Container Platform 4.21.24 bug fix and security update
Released 2026-07-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
Fixes 5 records
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02808 · Published 2026-03-31 · Partial fix · 4.18.1, 4.18.0 CWE-94
Priority MEDIUM 40
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00692 · Published 2026-06-29 · Partial fix · 4.0.1, 3.1.3 +1 CWE-436
Priority LOW 39
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00512 · Published 2026-05-05 · Partial fix · 3.1.2, 2.4.1 CWE-436
Priority LOW 36
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
CVSS 4.0HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00407 · Published 2026-05-13 · Partial fix · 7.5.6, 8.0.2 CWE-94
Priority LOW 29
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00163 · Published 2026-06-15 · Partial fix · 5.2.5 CWE-346
THREATIST.IORead the docs