Red Hat Security Advisory

RHSA-2026:86618

New container image: rhceph-9.2

Released 2026-10-21 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10

Fixes 54 records

TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7

Server-side request forgery in axios

HIGH 82

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00711 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-183

TI-2026-25647 CVE-2026-33228 · GHSA-rf6f-7fwh-wjgh

flatted: Prototype Pollution via parse()

HIGH 80

flatted is a circular JSON parser.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00856 Published 2026-03-20 Partial fix · 3.4.2 CWE-1321

TI-2026-26254 CVE-2026-33896 · GHSA-2328-f5f3-gj25

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

HIGH 74

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00361 Published 2026-03-27 Partial fix · 1.4.0 CWE-295

TI-2026-30423 CVE-2026-42044 · GHSA-3w6x-2g7m-8v23

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00618 Published 2026-04-24 Partial fix · 1.15.2 CWE-1321

TI-2026-26253 CVE-2026-33895 · GHSA-q67f-28xg-22rw

Forge has signature forgery in Ed25519 due to missing S > L check

HIGH 72

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00527 Published 2026-03-27 Partial fix · 1.4.0 CWE-347

TI-2026-26252 CVE-2026-33894 · GHSA-ppp5-5v6c-4jwp

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

HIGH 72

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00481 Published 2026-03-27 Partial fix · 1.4.0 CWE-20

TI-2026-26249 CVE-2026-33891 · GHSA-5m6q-g25r-mvwx

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

HIGH 72

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00607 Published 2026-03-27 Partial fix · 1.4.0 CWE-835

TI-2026-24678 CVE-2026-32141 · GHSA-25h7-pfq9-p65f

flatted: Unbounded recursion DoS in parse() revive phase

HIGH 72

flatted is a circular JSON parser.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00898 Published 2026-03-12 Partial fix · 3.4.0 CWE-674

TI-2025-42946 CVE-2025-69873 · GHSA-2g4f-4pwh-qvx6

Regular expression denial of service in ajv.js ajv

HIGH 72

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00539 Published 2026-02-11 Partial fix · 6.14.0, 8.17.2 +1 CWE-1333

TI-2025-36412 CVE-2025-58754 · GHSA-4hjh-wcwx-xvwj

Axios is vulnerable to DoS attack through lack of data size check

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01196 Published 2025-09-12 Partial fix · 1.12.0, 0.30.2 CWE-770

TI-2026-30418 CVE-2026-42039 · GHSA-62hf-57xw-28j9

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

HIGH 70

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00772 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-674

TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

HIGH 68

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00403 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-113

TI-2026-30412 CVE-2026-42033 · GHSA-pf86-5x62-jrwf

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

HIGH 68

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00867 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-1321

TI-2024-32613 CVE-2024-48916

Ceph is vulnerable to authentication bypass through RadosGW

HIGH 68

Ceph is a distributed object, block, and file storage platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00221 Published 2025-07-30 Partial fix CWE-345

TI-2025-38908 CVE-2025-62718 · GHSA-3p68-rc4w-qgx5

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

HIGH 67

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.01207 Published 2026-04-09 Partial fix · 1.15.0, 0.31.0 CWE-441

TI-2026-30417 CVE-2026-42038 · GHSA-m7pr-hjqh-92cm

Axios: no_proxy bypass via IP alias allows SSRF

HIGH 66

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00324 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-918

TI-2026-22248 CVE-2026-27904 · GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

HIGH 66

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00525 Published 2026-02-26 Partial fix · 10.2.3, 9.0.7 +6 CWE-1333

TI-2026-22247 CVE-2026-27903 · GHSA-7r86-cg39-jmmj

minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

HIGH 66

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00576 Published 2026-02-26 Partial fix · 10.2.3, 9.0.7 +6 CWE-407

TI-2024-32120 CVE-2024-47866

RGW DoS attack with empty HTTP header in S3 object copy

HIGH 66

Ceph is a distributed object, block, and file storage platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00479 Published 2025-11-12 Partial fix CWE-20

TI-2026-29847 CVE-2026-41238 · GHSA-v9jr-rg53-9pgp

DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

MEDIUM 64

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.0027 Published 2026-04-23 Partial fix · 3.4.0 CWE-1321

TI-2026-30415 CVE-2026-42036 · GHSA-vf2m-468p-8v99

Axios: HTTP adapter streamed responses bypass maxContentLength

MEDIUM 63

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00327 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-770

TI-2026-30413 CVE-2026-42034 · GHSA-5c9x-8gcm-mpgx

Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0

MEDIUM 63

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00327 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-770

TI-2026-30420 CVE-2026-42041 · GHSA-w9j2-pvgh-6h63

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

MEDIUM 62

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00656 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-1321

TI-2026-29908 CVE-2026-41305 · GHSA-qx2v-qp2m-jg93

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

MEDIUM 60

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00205 Published 2026-04-24 Partial fix · 8.5.10 CWE-79

TI-2026-29849 CVE-2026-41240 · GHSA-h7mw-gpvr-xq4m

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

MEDIUM 60

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00313 Published 2026-04-23 Partial fix · 3.4.0 CWE-183

TI-2026-28746 CVE-2026-39865 · GHSA-qj83-cq47-w5f8

Axios HTTP/2 Session Cleanup State Corruption Vulnerability

MEDIUM 60

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00744 Published 2026-04-08 Partial fix · 1.13.2 CWE-400

TI-2025-19705 CVE-2025-26791 · GHSA-vhxf-7vqr-mrjg

Cross-site scripting in cure53 DOMPurify

MEDIUM 60

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00605 Published 2025-02-14 Partial fix · 3.2.4 CWE-79

TI-2026-30421 CVE-2026-42042 · GHSA-xx6v-rp6x-q39c

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

MEDIUM 58

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0021 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-183

TI-2026-30416 CVE-2026-42037 · GHSA-445q-vr5w-6q77

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

MEDIUM 57

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00294 Published 2026-04-24 Partial fix · 1.15.1 CWE-93

TI-2026-28989 CVE-2026-40175 · GHSA-fvcv-3m26-pcqx

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

MEDIUM 57

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.01979 Published 2026-04-10 Partial fix · 1.15.0, 0.31.0 CWE-113

TI-2026-30419 CVE-2026-42040 · GHSA-xhjh-pmcv-23jw

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

MEDIUM 51

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00217 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-116

TI-2026-17326 CVE-2026-21441 · GHSA-38jv-5279-wg99

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

MEDIUM 50

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.02922 Published 2026-01-07 Partial fix · 2.6.3 CWE-409

TI-2026-21474 CVE-2026-26996 · GHSA-3ppc-4f35-3m26

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

MEDIUM 44

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00577 Published 2026-02-20 Partial fix · 10.2.1, 9.0.6 +6 CWE-1333

TI-2026-20739 CVE-2026-25639 · GHSA-43fc-jf86-j433

Axios affected by Denial of Service via proto Key in mergeConfig

MEDIUM 44

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02759 Published 2026-02-09 Partial fix · 1.13.5, 0.30.3 CWE-754

TI-2025-11739 CVE-2025-12816 · GHSA-5gfm-wpxj-wjgq

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and…

MEDIUM 44

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0058 Published 2025-11-25 Partial fix · 1.3.2 CWE-436

TI-2026-36920 CVE-2026-50152

Improper authorization in ceph

MEDIUM 41

Ceph is an open-source distributed storage platform providing object, block, and file storage.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00248 Published 2026-08-27 Partial fix · 19.2.6, 20.2.4 CWE-285

TI-2025-40561 CVE-2025-66035 · GHSA-58c5-g7wp-6w37

Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs

MEDIUM 41

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00716 Published 2025-11-26 Partial fix · 21.0.1, 20.3.14 +1 CWE-201

TI-2026-26051 CVE-2026-33671 · GHSA-c2c7-rcm5-vvqj

Picomatch has a ReDoS vulnerability via extglob quantifiers

LOW 39

Picomatch is a glob matcher written JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0042 Published 2026-03-26 Partial fix · 4.0.4, 3.0.2 +1 CWE-1333

TI-2026-18171 CVE-2026-22610 · GHSA-jrmj-c5cx-3cw6

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

LOW 39

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00439 Published 2026-01-10 Partial fix · 21.1.0-rc.0, 21.0.7 +2 CWE-79

TI-2025-21495 CVE-2025-30156

Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

LOW 39

Ceph is an open-source distributed storage platform providing object, block, and file storage.

CVSS 3.1HIGH 8.9 Adjacent network Low privileges No interaction EPSS 0.00093 Published 2026-08-27 Partial fix · 19.2.6, 20.2.4 CWE-327

TI-2025-36904 CVE-2025-59343 · GHSA-vj76-c3g6-qr5v

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

LOW 38

tar-fs provides filesystem bindings for tar-stream.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0058 Published 2025-09-24 Partial fix · 3.1.1, 2.1.3 +3 CWE-22

TI-2025-40848 CVE-2025-66412 · GHSA-v4hv-rgfq-gp49

Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

LOW 37

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00383 Published 2025-12-01 Partial fix · 21.0.2, 20.3.15 +1 CWE-79

TI-2026-22313 CVE-2026-27970 · GHSA-prjf-86w9-mfqv

Angular i18n vulnerable to Cross-Site Scripting (XSS)

LOW 36

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00547 Published 2026-02-26 Partial fix · 21.2.0, 21.1.6 +2 CWE-79

TI-2025-40556 CVE-2025-66030 · GHSA-65ch-62r8-g69g

node-forge ASN.1 OID Integer Truncation

LOW 34

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0033 Published 2025-11-26 Partial fix · 1.3.2 CWE-190

TI-2026-29848 CVE-2026-41239 · GHSA-crv5-9vww-q3g8

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

LOW 32

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00248 Published 2026-04-23 Partial fix · 3.4.0 CWE-1289

TI-2026-29551 CVE-2026-40895

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

LOW 31

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00486 Published 2026-04-21 Partial fix · 1.16.0 CWE-200

TI-2026-26052 CVE-2026-33672 · GHSA-3v7f-55p6-f55p

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

LOW 30

Picomatch is a glob matcher written JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00425 Published 2026-03-26 Partial fix · 4.0.4, 3.0.2 +1 CWE-1321

TI-2023-24799 CVE-2023-46159 · GHSA-p56v-8px4-hjvv

IBM Storage Ceph denial of service

LOW 30

IBM Storage Ceph 5.3z1, 5.3z5, and 6.1z1 could allow an authenticated user on the network to cause a denial of service from RGW.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00812 Published 2024-02-02 Fixed CWE-20

TI-2026-41927 CVE-2026-58224 · GHSA-ph76-744q-p8fh

Samba: ctdb fails to do integrity checking of received packets

LOW 29

A flaw was found in Samba's CTDB, the clustered database service used by Samba.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00344 Published 2026-08-14 Partial fix · 1790843527 CWE-353

TI-2025-32065 CVE-2025-50182 · GHSA-48p4-8xcf-vxj5

urllib3 does not control redirects in browsers and Node.js

LOW 28

urllib3 is a user-friendly HTTP client library for Python.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00602 Published 2025-06-19 Partial fix · 2.5.0 CWE-601

TI-2025-32064 CVE-2025-50181 · GHSA-pq67-6m6q-mj2v

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

LOW 28

urllib3 is a user-friendly HTTP client library for Python.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00474 Published 2025-06-19 Partial fix · 2.5.0 CWE-601

TI-2026-00343 CVE-2026-0540 · GHSA-v2wj-7wpq-c8vv

DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

LOW 24

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext eleme…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00388 Published 2026-03-03 Partial fix · 3.3.2, 2.5.9 CWE-79

TI-2025-14230 CVE-2025-15599 · GHSA-v8jm-5vwx-cfxm

DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML

LOW 23

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the S…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00289 Published 2026-03-03 Partial fix · 3.2.7 CWE-79

TI-2024-36887 CVE-2024-55565 · GHSA-mwcw-c2x4-8c55

nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.

LOW 21

nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00665 Published 2024-12-09 Partial fix · 5.0.9, 3.3.8 CWE-835