RHSA-2026:56789

Axios is a promise based HTTP client for the browser and Node.js.

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes.

gRPC-Go is the Go language implementation of gRPC.

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Prometheus is an open-source monitoring system and time series database.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy.

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers.