Read the docs
TI-2025-12309 Aliases CVE-2025-13465GHSA-xxjr-mmjv-4gpg

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Priority MEDIUM 40CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 80 fixed, 33 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01823 78th percentileScored 2026-11-07
Fix Partial lodash (Lodash): 4.17.23lodash-amd (Lodash): 4.17.23+8 more productsRed Hat: 86 advisoriesRed Hat: 80 fixed, 33 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lodashlodash4.0.0 to before 4.17.234.17.23Patch availableCNA
lodashlodash-amd4.0.0 to before 4.17.234.17.23Patch availableCNA
lodashlodash-es4.0.0 to before 4.17.234.17.23Patch availableCNA
lodashlodash.unset4.0.0 to before 4.18.04.18.0Patch availableCNA
lodashlodash.omit4.0.0 to before 4.18.04.18.0Patch availableCNA
—lodash (npm)4.0.0 to before 4.17.234.17.23Patch availableGHSA-xxjr-mmjv-4gpg
—lodash-amd (npm)4.0.0 to before 4.17.234.17.23Patch availableGHSA-xxjr-mmjv-4gpg
—lodash-es (npm)4.0.0 to before 4.17.234.17.23Patch availableGHSA-xxjr-mmjv-4gpg
—lodash.omit (npm)4.0.0 to before 4.18.04.18.0Patch availableGHSA-xxjr-mmjv-4gpg
—lodash.unset (npm)4.0.0 to before 4.18.04.18.0Patch availableGHSA-xxjr-mmjv-4gpg
  • lodash Vendorlodash Affected 4.0.0 to before 4.17.23 Fixed in 4.17.23 Patch available CNA
  • lodash-amd Vendorlodash Affected 4.0.0 to before 4.17.23 Fixed in 4.17.23 Patch available CNA
  • lodash-es Vendorlodash Affected 4.0.0 to before 4.17.23 Fixed in 4.17.23 Patch available CNA
  • lodash.unset Vendorlodash Affected 4.0.0 to before 4.18.0 Fixed in 4.18.0 Patch available CNA
  • lodash.omit Vendorlodash Affected 4.0.0 to before 4.18.0 Fixed in 4.18.0 Patch available CNA
  • lodash (npm) Vendor— Affected 4.0.0 to before 4.17.23 Fixed in 4.17.23 Patch available GHSA-xxjr-mmjv-4gpg
  • lodash-amd (npm) Vendor— Affected 4.0.0 to before 4.17.23 Fixed in 4.17.23 Patch available GHSA-xxjr-mmjv-4gpg
  • lodash-es (npm) Vendor— Affected 4.0.0 to before 4.17.23 Fixed in 4.17.23 Patch available GHSA-xxjr-mmjv-4gpg
  • lodash.omit (npm) Vendor— Affected 4.0.0 to before 4.18.0 Fixed in 4.18.0 Patch available GHSA-xxjr-mmjv-4gpg
  • lodash.unset (npm) Vendor— Affected 4.0.0 to before 4.18.0 Fixed in 4.18.0 Patch available GHSA-xxjr-mmjv-4gpg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*4.0.0 to before 4.17.23Vulnerablelodash
  • cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* Versions 4.0.0 to before 4.17.23 Vulnerable ·lodash

Remediation

  • Fix · CNA lodash (Lodash) Fixed in 4.17.23
  • Fix · CNA lodash-amd (Lodash) Fixed in 4.17.23
  • Fix · CNA lodash-es (Lodash) Fixed in 4.17.23
  • Fix · CNA lodash.unset (Lodash) Fixed in 4.18.0
  • Fix · CNA lodash.omit (Lodash) Fixed in 4.18.0
  • Fix · GHSA-xxjr-mmjv-4gpg lodash (npm) Fixed in 4.17.23 Advisory →
  • Fix · GHSA-xxjr-mmjv-4gpg lodash-amd (npm) Fixed in 4.17.23 Advisory →
  • Fix · GHSA-xxjr-mmjv-4gpg lodash-es (npm) Fixed in 4.17.23 Advisory →
  • Fix · GHSA-xxjr-mmjv-4gpg lodash.omit (npm) Fixed in 4.18.0 Advisory →
  • Fix · GHSA-xxjr-mmjv-4gpg lodash.unset (npm) Fixed in 4.18.0 Advisory →

Red Hat 86 advisories

  • RHSA-2026:83622 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:83619 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2026:57487 Released 2026-08-26 · Red Hat rating Important
    OpenShift Container Platform 4.18.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator +2
Show 83 more Red Hat advisories
  • RHSA-2026:41944 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:41941 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:41064 Released 2026-07-16 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.10 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:40945 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:40118 Released 2026-07-15 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:34100 Released 2026-07-09 · Red Hat rating Important
    OpenShift Container Platform 4.17.55 security and extras update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9 +6
  • RHSA-2026:36882 Released 2026-07-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10
  • RHSA-2026:36651 Released 2026-07-08 · Red Hat rating Important
    Red Hat Edge Manager Version 1.0.3 Security Update
    • Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
  • RHSA-2026:34608 Released 2026-07-02 · Red Hat rating Important
    Streams for Apache Kafka 2.9.4 release and security update
    • Streams for Apache Kafka 2.9.4
  • RHSA-2026:33371 Released 2026-06-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.18 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-rt-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-services-3.4.10-4.SP2_redhat_00004.1.el7eap +7
  • RHSA-2026:33154 Released 2026-06-29 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2026:25089 Released 2026-06-10 · Red Hat rating Important
    HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO HawtIO 4.4.0
  • RHSA-2026:24331 Released 2026-06-08 · Red Hat rating Important
    cockpit-image-builder security update
    • Red Hat Enterprise Linux AppStream (v. 10) cockpit-image-builder-94.3-1.el10_2
  • RHSA-2026:21658 Released 2026-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.18.43 security and extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator +5
  • RHSA-2026:20088 Released 2026-05-29 · Red Hat rating Important
    OpenShift Container Platform 4.16.63 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:20042 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-dpu-cni-rhel9 +5
  • RHSA-2026:19712 Released 2026-05-20 · Red Hat rating Critical
    RHOAI 3.3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
  • RHSA-2026:17469 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.20.23 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9
  • RHSA-2026:18868 Released 2026-05-19 · Red Hat rating Important
    linux-sgx security update
    • Red Hat Enterprise Linux AppStream (v. 9) linux-sgx-2.26-7.el9, sgx-common-2.26-7.el9, sgx-libs-2.26-7.el9 +5
  • RHSA-2026:18480 Released 2026-05-19 · Red Hat rating Important
    linux-sgx security update
    • Red Hat Enterprise Linux AppStream (v. 10) linux-sgx-2.26-7.el10, sgx-common-2.26-7.el10, sgx-libs-2.26-7.el10 +5
  • RHSA-2026:14774 Released 2026-05-13 · Red Hat rating Important
    OpenShift Container Platform 4.15.64 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
  • RHSA-2026:15091 Released 2026-05-12 · Red Hat rating Important
    OpenShift Container Platform 4.14.65 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:14871 Released 2026-05-07 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:14870 Released 2026-05-07 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:13829 Released 2026-05-05 · Red Hat rating Important
    RHACS 4.10.2 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:13548 Released 2026-05-04 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.2 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +8
  • RHSA-2026:13542 Released 2026-05-04 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.2 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +1
  • RHSA-2026:11414 Released 2026-04-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.3 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +5
  • RHSA-2026:9848 Released 2026-04-22 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.10 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +1
  • RHSA-2026:8229 Released 2026-04-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9 +12
  • RHSA-2026:8218 Released 2026-04-15 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.5 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +5
  • RHSA-2026:6567 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.16.3
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:6497 Released 2026-04-02 · Red Hat rating Important
    Red Hat Quay 3.16.3
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:6288 Released 2026-03-31 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:6192 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.27.0 Release.
    • Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:5636 Released 2026-03-24 · Red Hat rating Important
    multicluster engine for Kubernetes v2.7.9 security update
    • multicluster engine for Kubernetes 2.7 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:5633 Released 2026-03-24 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.12.8 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9 +23
  • RHSA-2026:4423 Released 2026-03-19 · Red Hat rating Important
    OpenShift Container Platform 4.15.62 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
  • RHSA-2026:4782 Released 2026-03-17 · Red Hat rating Important
    Cluster Observability Operator 1.4.0
    • Cluster Observability Operator 1.4.0 registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-rhel9
  • RHSA-2026:4630 Released 2026-03-16 · Red Hat rating Important
    Red Hat Data Grid 8.6.0 security update
    • Red Hat Data Grid 8.6.0
  • RHSA-2026:4467 Released 2026-03-12 · Red Hat rating Important
    RHACS 4.9.4 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2026:4466 Released 2026-03-12 · Red Hat rating Important
    RHACS 4.8.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2026:3870 Released 2026-03-12 · Red Hat rating Important
    OpenShift Container Platform 4.12.86 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator, registry.redhat.io/openshift4/ose-cluster-etcd-rhel8-operator, registry.redhat.io/openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator +11
  • RHSA-2026:3962 Released 2026-03-06 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8
  • RHSA-2026:3960 Released 2026-03-06 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9 +9
  • RHSA-2026:3958 Released 2026-03-06 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.3-4.el10ap, receptorctl-1.6.3-4.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.9-1.el9ap, automation-controller-cli-4.7.9-1.el9ap, automation-controller-server-4.7.9-1.el9ap +8
  • RHSA-2026:3884 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.19.2 security update
    • Red Hat OpenShift GitOps 1.19 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8 +5
  • RHSA-2026:3874 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.18.4 security update
    • Red Hat OpenShift GitOps 1.18 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8 +6
  • RHSA-2026:3869 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.17.5 security update
    • Red Hat OpenShift GitOps 1.17 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8 +6
  • RHSA-2026:3422 Released 2026-03-05 · Red Hat rating Important
    OpenShift Container Platform 4.13.64 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator, registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8 +13
  • RHSA-2026:3825 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.3
    • Red Hat OpenShift Pipelines 1.20 registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9
  • RHSA-2026:3782 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 2.25.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +27
  • RHSA-2026:3712 Released 2026-03-04 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.15.4
    • Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8 +2
  • RHSA-2026:3710 Released 2026-03-04 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.15.3
    • Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8 +2
  • RHSA-2026:2990 Released 2026-02-26 · Red Hat rating Important
    OpenShift Container Platform 4.14.62 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator, registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8, registry.redhat.io/openshift4/ose-cluster-etcd-rhel8-operator +12
  • RHSA-2026:2984 Released 2026-02-24 · Red Hat rating Important
    OpenShift Container Platform 4.21.3 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:3087 Released 2026-02-23 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-console-rhel9, registry.redhat.io/rhtas/rhtas-console-ui-rhel9
  • RHSA-2026:2926 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-search-ui-rhel9 +6
  • RHSA-2026:2661 Released 2026-02-18 · Red Hat rating Important
    OpenShift Container Platform 4.16.57 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-hyperkube-rhel9, registry.redhat.io/openshift4/ose-ironic-agent-rhel9 +2
  • RHSA-2026:2672 Released 2026-02-18 · Red Hat rating Important
    OpenShift Container Platform 4.17.49 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/ose-cluster-config-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-etcd-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-kube-scheduler-rhel9-operator +6
  • RHSA-2026:2651 Released 2026-02-18 · Red Hat rating Important
    OpenShift Container Platform 4.19.24 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-vmware-vsphere-csi-driver-rhel9 +1
  • RHSA-2026:2900 Released 2026-02-18 · Red Hat rating Important
    Network Observability 1.11.0 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2
  • RHSA-2026:2817 Released 2026-02-17 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.4) pcs-0.11.7-2.el9_4.6, pcs-snmp-0.11.7-2.el9_4.6
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) pcs-0.11.7-2.el9_4.6, pcs-snmp-0.11.7-2.el9_4.6
  • RHSA-2026:2819 Released 2026-02-17 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.9.2) pcs-0.11.4-7.el9_2.7, pcs-snmp-0.11.4-7.el9_2.7
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) pcs-0.11.4-7.el9_2.7, pcs-snmp-0.11.4-7.el9_2.7
  • RHSA-2026:2816 Released 2026-02-17 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.6) pcs-0.11.9-2.el9_6.3, pcs-snmp-0.11.9-2.el9_6.3
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.6) pcs-0.11.9-2.el9_6.3, pcs-snmp-0.11.9-2.el9_6.3
  • RHSA-2026:2818 Released 2026-02-17 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v. 10.0) cockpit-ha-cluster-0.12.0-3.el10_0.4, pcs-0.12.0-3.el10_0.4, pcs-snmp-0.12.0-3.el10_0.4
  • RHSA-2026:2694 Released 2026-02-12 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:2675 Released 2026-02-12 · Red Hat rating Important
    Red Hat Developer Hub 1.8.3 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:2078 Released 2026-02-11 · Red Hat rating Important
    OpenShift Container Platform 4.18.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-baremetal-installer-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-insights-rhel9-operator +2
  • RHSA-2026:2119 Released 2026-02-11 · Red Hat rating Important
    OpenShift Container Platform 4.20.14 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9, registry.redhat.io/openshift4/ose-console-rhel9
  • RHSA-2026:2484 Released 2026-02-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.10, pcs-snmp-0.11.1-10.el9_0.10
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.10, pcs-snmp-0.11.1-10.el9_0.10
  • RHSA-2026:2469 Released 2026-02-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) pcs-0.10.12-6.el8_6.12, pcs-snmp-0.10.12-6.el8_6.12
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) pcs-0.10.12-6.el8_6.12, pcs-snmp-0.10.12-6.el8_6.12
  • RHSA-2026:2465 Released 2026-02-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) pcs-0.10.15-4.el8_8.10, pcs-snmp-0.10.15-4.el8_8.10
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) pcs-0.10.15-4.el8_8.10, pcs-snmp-0.10.15-4.el8_8.10
  • RHSA-2026:2462 Released 2026-02-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.10, pcs-snmp-0.10.8-1.el8_4.10
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) pcs-0.10.8-1.el8_4.10, pcs-snmp-0.10.8-1.el8_4.10
  • RHSA-2026:2452 Released 2026-02-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.10-1.el9_7.2, pcs-snmp-0.11.10-1.el9_7.2
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.10-1.el9_7.2, pcs-snmp-0.11.10-1.el9_7.2
  • RHSA-2026:2438 Released 2026-02-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 10) cockpit-ha-cluster-0.12.1-1.el10_1.2, pcs-0.12.1-1.el10_1.2, pcs-snmp-0.12.1-1.el10_1.2
  • RHSA-2026:2149 Released 2026-02-05 · Red Hat rating Important
    Kiali 2.17.3 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:2148 Released 2026-02-05 · Red Hat rating Important
    Kiali 2.11.6 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:2147 Released 2026-02-05 · Red Hat rating Important
    Kiali 2.4.12 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:2145 Released 2026-02-05 · Red Hat rating Important
    Kiali 1.73.26 for Red Hat OpenShift Service Mesh 2.6
    • Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8
  • RHSA-2026:1845 Released 2026-02-03 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-rhel9 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Migration Toolkit for Applications 8AffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 4AffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Edge Manager previewAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat Trusted Profile AnalyzerAffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix yet
streams for Apache Kafka 3AffectedNo fix yet
Cluster Observability Operator 1.4.0Fixed RHSA-2026:4782
Cryostat 4 on RHEL 9Fixed RHSA-2026:1845
HawtIO HawtIO 4.4.0Fixed RHSA-2026:25089
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:2900
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:41064
Red Hat Advanced Cluster Management for Kubernetes 2.12Fixed RHSA-2026:5633
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:8229
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:36882
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:13548
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:4466
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:4467
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:13829
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:3962
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:3960
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:3958
Red Hat Ceph Storage 7.1Fixed RHSA-2026:33154
Red Hat Data Grid 8.6.0Fixed RHSA-2026:4630
Red Hat Developer Hub 1.8Fixed RHSA-2026:2675
Red Hat Discovery 2Fixed RHSA-2026:2694
Red Hat Edge Manager 1.0Fixed RHSA-2026:36651
Red Hat Edge Manager 1.1Fixed RHSA-2026:40118, RHSA-2026:40945
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:18480, RHSA-2026:24331
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:18868
Red Hat Enterprise Linux High Availability (v. 10)Fixed RHSA-2026:2438
Red Hat Enterprise Linux High Availability (v. 9)Fixed RHSA-2026:2452
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2026:2462
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2026:2469
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2026:2465
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2026:2484
Red Hat Enterprise Linux High Availability E4S (v.9.2)Fixed RHSA-2026:2819
Red Hat Enterprise Linux High Availability EUS (v. 10.0)Fixed RHSA-2026:2818
Red Hat Enterprise Linux High Availability EUS (v.9.4)Fixed RHSA-2026:2817
Red Hat Enterprise Linux High Availability EUS (v.9.6)Fixed RHSA-2026:2816
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2026:2469
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2026:2465
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2026:2462
Red Hat Enterprise Linux Resilient Storage (v. 9)Fixed RHSA-2026:2452
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)Fixed RHSA-2026:2819
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)Fixed RHSA-2026:2817
Red Hat Enterprise Linux Resilient Storage EUS (v.9.6)Fixed RHSA-2026:2816
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2026:2484
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2026:33371
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat OpenShift AI 2.25Fixed RHSA-2026:3782
Red Hat OpenShift AI 3.3Fixed RHSA-2026:19712
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:3870
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:3422
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:15091, RHSA-2026:2990
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:14774, RHSA-2026:4423
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:20088, RHSA-2026:2661
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:2672, RHSA-2026:34100
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:2078, RHSA-2026:21658, RHSA-2026:57487
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:20042, RHSA-2026:2651
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:17469, RHSA-2026:2119
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:2984
Red Hat OpenShift Dev Spaces 3.27Fixed RHSA-2026:6192
Red Hat OpenShift GitOps 1.17Fixed RHSA-2026:3869
Red Hat OpenShift GitOps 1.18Fixed RHSA-2026:3874
Red Hat OpenShift GitOps 1.19Fixed RHSA-2026:3884
Red Hat OpenShift Pipelines 1.15Fixed RHSA-2026:3710
Red Hat OpenShift Pipelines 1.20Fixed RHSA-2026:3825
Red Hat OpenShift Service Mesh 2.6Fixed RHSA-2026:2145
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:2147
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:2148
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:2149
Red Hat Openshift Data Foundation 4.16Fixed RHSA-2026:83619
Red Hat Openshift Data Foundation 4.17Fixed RHSA-2026:83622
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:41941
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:40984
Red Hat Quay 3.16Fixed RHSA-2026:6497, RHSA-2026:6567
Red Hat Satellite 6.18Fixed RHSA-2026:14870, RHSA-2026:14871, RHSA-2026:6288
Red Hat Trusted Artifact Signer 1.2Fixed RHSA-2026:2926
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:3087
Streams for Apache Kafka 2.9.4Fixed RHSA-2026:34608
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:13542
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:9848
multicluster engine for Kubernetes 2.7Fixed RHSA-2026:5636
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:8218
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:11414
Not affected: 79 products
  • Cluster Observability Operator 1.4.0
  • Confidential Compute Attestation
  • Cryostat 4 on RHEL 9
  • Gatekeeper 3
  • Logging Subsystem for Red Hat OpenShift
  • Multicluster Engine for Kubernetes
  • Network Observability (NETOBSERV) 1.11.0
  • Node HealthCheck Operator
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.12
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Security 4
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ceph Storage 7.1
  • Red Hat Developer Hub 1.8
  • Red Hat Directory Server 11
  • Red Hat Directory Server 12
  • Red Hat Directory Server 13
  • Red Hat Discovery 2
  • Red Hat Edge Manager 1.0
  • Red Hat Edge Manager 1.1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces 3.27
  • Red Hat OpenShift GitOps 1.17
  • Red Hat OpenShift GitOps 1.18
  • Red Hat OpenShift GitOps 1.19
  • Red Hat OpenShift Pipelines 1.15
  • Red Hat OpenShift Pipelines 1.20
  • Red Hat OpenShift Service Mesh 3.2
  • Red Hat Openshift Data Foundation 4.16
  • Red Hat Openshift Data Foundation 4.17
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Process Automation 7
  • Red Hat Quay 3
  • Red Hat Quay 3.16
  • Red Hat Satellite 6
  • Red Hat Trusted Artifact Signer 1.2
  • Red Hat Trusted Artifact Signer 1.3
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.7
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-13465
  2. 2026-10-03 Alias added: GHSA-xxjr-mmjv-4gpg
  3. 2026-10-07 Fix available: Red Hat OpenShift Pipelines 1.20 · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-15 Fix available: Lodash/[email protected], Lodash/[email protected], Lodash/[email protected] +2 · CNA
  6. 2026-10-15 1 new reference · CNA
  7. 2026-10-16 Fix available: RHSA-2026:83619 · Red Hat
  8. 2026-10-16 Fix available: RHSA-2026:83622 · Red Hat
  9. 2026-10-16 Fix available: Red Hat Openshift Data Foundation 4.16, Red Hat Openshift Data Foundation 4.17 · Red Hat
  10. 2026-11-04 Fix available: npm/[email protected], npm/[email protected] · GHSA-xxjr-mmjv-4gpg
  11. 2026-11-04 88 new references · GHSA-xxjr-mmjv-4gpg
  12. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat

References

Advisory 2

Other 91

  • TI-2021-06035 Command injection in Lodash CVSS 3.1HIGH 7.2
  • TI-2026-04185 lodash vulnerable to Code Injection via `_.template` imports key names CVSS 3.1CRITICAL 9.8
  • TI-2019-08009 Prototype pollution in Snyk lodash CVSS 3.1CRITICAL 9.1
  • TI-2020-06621 Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. CVSS 3.1HIGH 7.4
  • TI-2020-17303 Regular expression denial of service (ReDoS) in Lodash CVSS 3.1MEDIUM 5.3
  • TI-2026-02542 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences