RHSA-2026:70267

Pillow is a Python imaging library.

form-data is a library for creating readable multipart/form-data streams.

Axios is a promise based HTTP client for the browser and Node.js.

Pillow is a Python imaging library.

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

Axios is a promise based HTTP client for the browser and Node.js.

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

js-yaml is a JavaScript YAML parser and dumper.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.

Pillow is a Python imaging library.

tmp is a temporary file and directory creator for node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

PyJWT is a JSON Web Token implementation in Python.

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js).

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively…

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

js-yaml is a JavaScript YAML parser and dumper.

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

pyasn1 is a generic ASN.1 library for Python.

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface.

urllib3 is an HTTP client library for Python.

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Prometheus is an open-source monitoring system and time series database.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

brace-expansion through 5.0.6 is vulnerable to denial of service.

pyasn1 is a generic ASN.1 library for Python.

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Prometheus is an open-source monitoring system and time series database.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter.

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

A flaw was found in Quay.

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

Podman is a tool for managing OCI containers and pods.

A flaw was found in Red Hat Quay's repository-level mirror configuration feature.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.

A flaw was found in Red Hat Quay's Proxy Cache configuration feature.