TI-2026-57986 CVE-2026-84375 · GHSA-2883-xcg3-v3hh
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Priority MEDIUM 40
js-yaml is a JavaScript YAML parser and dumper.
RHSA-2026:83703
OpenShift Container Platform 4.21.39 security and extras update
Released 2026-10-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9 +6
Fixes 7 records
TI-2026-32373 CVE-2026-44432 · GHSA-mf9v-mfxr-j63j
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Priority MEDIUM 40
urllib3 is an HTTP client library for Python.
TI-2026-26186 CVE-2026-33814
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
TI-2026-65313 CVE-2026-102278 · GHSA-qhr7-859c-m2p7
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
Priority LOW 39
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
TI-2026-32372 CVE-2026-44431 · GHSA-qccp-gfcp-xxvc
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Priority LOW 36
urllib3 is an HTTP client library for Python.
TI-2026-09781 CVE-2026-11332 · GHSA-w8p5-mx5w-cpqj
Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution
Priority LOW 35
A flaw was found in ansible-core.