Cluster Observability Operator (Redhat) - vulnerabilities (CVEs)

41 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2026-06-29. Vendor: Redhat.

CVEs of Cluster Observability Operator

• CVE-2026-13676 - CVSS 7.5 (high), 2026-06-29: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that…
• CVE-2026-9697 - CVSS 7.4 (high), 2026-06-17: Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection…
• CVE-2026-6734 - CVSS 8.8 (high), 2026-06-17: Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the…
• CVE-2026-12151 - CVSS 7.5 (high), 2026-06-17: Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number…
• CVE-2026-48779 - CVSS 7.5 (high), 2026-06-16: ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up…
• CVE-2026-12143 - CVSS 8.7 (high), 2026-06-12: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the…
• CVE-2026-27145 - CVSS 7.5 (high), 2026-06-02: (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused…
• CVE-2024-52011 - CVSS 8.3 (high), 2026-06-01: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file`…
• CVE-2026-39821 - CVSS 9.6 (critical), 2026-05-22: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")…
• CVE-2026-9277 - CVSS 9.2 (critical), 2026-05-22: shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped…
• CVE-2026-46595 - CVSS 10 (critical), 2026-05-22: Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key,…
• CVE-2026-42508 - CVSS 9.1 (critical), 2026-05-22: Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for…
• CVE-2026-39832 - CVSS 9.1 (critical), 2026-05-22: When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination…
• CVE-2026-39830 - CVSS 9.1 (critical), 2026-05-22: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine…
• CVE-2026-39829 - CVSS 7.5 (high), 2026-05-22: The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter…
• CVE-2026-33814 - CVSS 7.5 (high), 2026-05-07: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a…
• CVE-2026-6322 - CVSS 7.5 (high), 2026-05-05: fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A…
• CVE-2026-6321 - CVSS 7.5 (high), 2026-05-04: fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path…
• CVE-2026-40895 - CVSS 7.5 (high), 2026-04-21: follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an…
• CVE-2026-35469 - CVSS 8.7 (high), 2026-04-16: spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate…
• CVE-2025-62718 - CVSS 9.9 (critical), 2026-04-09: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when…
• CVE-2026-29181 - CVSS 7.5 (high), 2026-04-07: OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value…
• CVE-2026-4800 - CVSS 9.8 (critical), 2026-03-31: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both…
• CVE-2026-33941 - CVSS 8.3 (high), 2026-03-27: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler…
• CVE-2026-33940 - CVSS 8.1 (high), 2026-03-27: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template…
• CVE-2026-33939 - CVSS 7.5 (high), 2026-03-27: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator…
• CVE-2026-33938 - CVSS 8.1 (high), 2026-03-27: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is…
• CVE-2026-33937 - CVSS 9.8 (critical), 2026-03-27: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed…
• CVE-2026-33896 - CVSS 9.1 (critical), 2026-03-27: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()`…
• CVE-2026-33895 - CVSS 7.5 (high), 2026-03-27: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification…
• CVE-2026-33891 - CVSS 7.5 (high), 2026-03-27: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS)…
• CVE-2026-33894 - CVSS 7.5 (high), 2026-03-27: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature…
• CVE-2026-32285 - CVSS 7.5 (high), 2026-03-26: The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic,…
• CVE-2026-33228 - CVSS 9.8 (critical), 2026-03-20: flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as…
• CVE-2026-2229 - CVSS 7.5 (high), 2026-03-12: ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the…
• CVE-2026-1528 - CVSS 7.5 (high), 2026-03-12: ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends…
• CVE-2026-1526 - CVSS 7.5 (high), 2026-03-12: The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a…
• CVE-2026-32141 - CVSS 7.5 (high), 2026-03-12: flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized…
• CVE-2026-29063 - CVSS 9.8 (critical), 2026-03-06: Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via…
• CVE-2025-13465 - CVSS 8.2 (high), 2026-01-21: The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from…
• CVE-2025-2843 - CVSS 8.8 (high), 2025-11-12: A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom…