Red Hat Security AdvisoryRHSA-2026:83622
Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
Released 2026-10-15 · Red Hat rating Important · View on Red Hat →
Fixes 17 records
Priority HIGH 72
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00539 · Published 2026-02-11 · Partial fix · 6.14.0, 8.17.2 +1 CWE-1333
Priority HIGH 66
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00525 · Published 2026-02-26 · Partial fix · 10.2.3, 9.0.7 +6 CWE-1333
Priority MEDIUM 51
Webpack is a module bundler.
CVSS 3.1LOW 3.7· Network · Low privileges · User interaction · EPSS 0.0023 · Published 2026-02-05 · Partial fix · 5.104.1 CWE-918
Priority MEDIUM 51
Webpack is a module bundler.
CVSS 3.1LOW 3.7· Network · Low privileges · User interaction · EPSS 0.0023 · Published 2026-02-05 · Partial fix · 5.104.0 CWE-918
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01619 · Published 2026-03-20 · Partial fix · 1.79.3 CWE-285
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02808 · Published 2026-03-31 · Partial fix · 4.18.1, 4.18.0 CWE-94
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0099 · Published 2026-03-06 · Partial fix · 3.8.3, 4.3.7 +2 CWE-1321
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00577 · Published 2026-02-20 · Partial fix · 10.2.1, 9.0.6 +6 CWE-1333
Priority MEDIUM 44
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00446 · Published 2025-11-26 · Partial fix · 1.3.2 CWE-674
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0058 · Published 2025-11-25 · Partial fix · 1.3.2 CWE-436
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02292 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
Priority MEDIUM 40
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00634 · Published 2026-05-04 · Partial fix · 3.1.1, 2.4.1 CWE-22
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01823 · Published 2026-01-21 · Partial fix · 4.17.23, 4.18.0 CWE-1321
Priority LOW 38
React Router is a router for React.
CVSS 3.1HIGH 8.0· Network · No auth · User interaction · EPSS 0.00866 · Published 2026-01-10 · Partial fix · 7.12.0, 1.23.2 CWE-79
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0045 · Published 2025-12-29 · Partial fix · 6.14.1 CWE-20
Priority LOW 33
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0049 · Published 2025-12-02 · Partial fix · 1.24.11, 1.25.5 CWE-295
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00443 · Published 2025-10-29 · Partial fix · 1.24.8, 1.25.2
THREATIST.IORead the docs