Openshift Lightspeed (Redhat) - vulnerabilities (CVEs)

76 CVEs, 1 in the last 30 days, 7 known versions, newest CVE from 2026-10-21. Vendor: Redhat.

CVEs of Openshift Lightspeed

• CVE-2026-114236 - CVSS 3.3 (low), 2026-10-21: storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls…
• CVE-2026-13676 - CVSS 7.5 (high), 2026-06-29: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that…
• CVE-2026-48746 - CVSS 9.1 (critical), 2026-06-22: vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust…
• CVE-2026-54293 - CVSS 7.5 (high), 2026-06-22: NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language…
• CVE-2026-48818 - CVSS 7.5 (high), 2026-06-17: Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as…
• CVE-2026-48779 - CVSS 7.5 (high), 2026-06-16: ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up…
• CVE-2026-46625 - CVSS 7.5 (high), 2026-06-10: JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with…
• CVE-2026-41567 - CVSS 7.5 (high), 2026-06-05: Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to…
• CVE-2026-5241 - CVSS 9.6 (critical), 2026-06-03: A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute…
• CVE-2026-27145 - CVSS 7.5 (high), 2026-06-02: (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused…
• CVE-2026-34993 - CVSS 7.3 (high), 2026-06-02: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may…
• CVE-2024-52011 - CVSS 8.3 (high), 2026-06-01: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file`…
• CVE-2026-8643 - CVSS 8 (high), 2026-06-01: pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory,…
• CVE-2026-45292 - CVSS 7.5 (high), 2026-05-28: opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to…
• CVE-2026-48526 - CVSS 7.4 (high), 2026-05-28: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC…
• CVE-2026-48710 - CVSS 6.5 (medium), 2026-05-26: Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct…
• CVE-2026-44209 - CVSS 7.5 (high), 2026-05-26: Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render…
• CVE-2026-39821 - CVSS 9.6 (critical), 2026-05-22: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")…
• CVE-2026-9277 - CVSS 9.2 (critical), 2026-05-22: shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped…
• CVE-2026-45736 - CVSS 7.5 (high), 2026-05-15: ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory…
• CVE-2026-42561 - CVSS 7.5 (high), 2026-05-13: Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header…
• CVE-2026-44432 - CVSS 8.9 (high), 2026-05-13: urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1)…
• CVE-2026-42499 - CVSS 7.5 (high), 2026-05-07: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
• CVE-2026-39820 - CVSS 7.5 (high), 2026-05-07: Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
• CVE-2026-33814 - CVSS 7.5 (high), 2026-05-07: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a…
• CVE-2026-33811 - CVSS 7.5 (high), 2026-05-07: When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
• CVE-2026-6322 - CVSS 7.5 (high), 2026-05-05: fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A…
• CVE-2026-42154 - CVSS 7.5 (high), 2026-05-04: Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not…
• CVE-2026-42151 - CVSS 7.5 (high), 2026-05-04: Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote…
• CVE-2026-41481 - CVSS 6.5 (medium), 2026-04-24: LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2,…
• CVE-2026-40938 - CVSS 8.5 (high), 2026-04-21: Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4,…
• CVE-2026-40895 - CVSS 7.5 (high), 2026-04-21: follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an…
• CVE-2026-40192 - CVSS 8.7 (high), 2026-04-15: Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making…
• CVE-2026-39892 - CVSS 9.8 (critical), 2026-04-08: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous…
• CVE-2026-32280 - CVSS 7.5 (high), 2026-04-08: During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in…
• CVE-2026-33810 - CVSS 8.8 (high), 2026-04-08: When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different…
• CVE-2026-32283 - CVSS 7.5 (high), 2026-04-08: If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled…
• CVE-2026-34986 - CVSS 7.5 (high), 2026-04-06: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE),…
• CVE-2026-34742 - CVSS 8.1 (high), 2026-04-02: The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by…
• CVE-2026-4800 - CVSS 9.8 (critical), 2026-03-31: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both…
• CVE-2026-34070 - CVSS 7.5 (high), 2026-03-31: LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read…
• CVE-2026-4926 - CVSS 7.5 (high), 2026-03-26: Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated…
• CVE-2026-33236 - CVSS 8.1 (high), 2026-03-20: NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language…
• CVE-2026-33231 - CVSS 7.5 (high), 2026-03-20: NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language…
• CVE-2026-33186 - CVSS 9.1 (critical), 2026-03-20: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the…
• CVE-2026-32829 - CVSS 8.2 (high), 2026-03-20: lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak…
• CVE-2026-30922 - CVSS 7.5 (high), 2026-03-18: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled…
• CVE-2026-32597 - CVSS 7.5 (high), 2026-03-13: PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11.…
• CVE-2026-1528 - CVSS 7.5 (high), 2026-03-12: ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends…
• CVE-2026-2229 - CVSS 7.5 (high), 2026-03-12: ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the…
• CVE-2026-1526 - CVSS 7.5 (high), 2026-03-12: The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a…
• CVE-2026-32274 - CVSS 8.7 (high), 2026-03-12: Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is…
• CVE-2026-28356 - CVSS 7.5 (high), 2026-03-12: multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a…
• CVE-2026-0846 - CVSS 8.6 (high), 2026-03-09: A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input…
• CVE-2026-25679 - CVSS 7.5 (high), 2026-03-06: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
• CVE-2026-27137 - CVSS 7.5 (high), 2026-03-06: When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different…
• CVE-2026-29063 - CVSS 9.8 (critical), 2026-03-06: Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via…
• CVE-2026-0847 - CVSS 8.6 (high), 2026-03-04: A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including…
• CVE-2026-27896 - CVSS 7.5 (high), 2026-02-26: The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library…
• CVE-2025-14009 - CVSS 10 (critical), 2026-02-18: A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses…
• CVE-2026-25990 - CVSS 8.6 (high), 2026-02-11: Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This…
• CVE-2026-26007 - CVSS 8.2 (high), 2026-02-10: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or…
• CVE-2025-61726 - CVSS 7.5 (high), 2026-01-28: The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited…
• CVE-2026-24486 - CVSS 8.6 (high), 2026-01-27: Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default…
• CVE-2026-0775 - CVSS 7 (high), 2026-01-23: npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected…
• CVE-2026-24049 - CVSS 7.1 (high), 2026-01-22: wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable…
• CVE-2025-13465 - CVSS 8.2 (high), 2026-01-21: The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from…
• CVE-2026-23950 - CVSS 8.8 (high), 2026-01-20: node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path…
• CVE-2026-23745 - CVSS 8.2 (high), 2026-01-16: node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths…
• CVE-2026-23490 - CVSS 7.5 (high), 2026-01-16: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed…
• CVE-2025-61686 - CVSS 9.1 (critical), 2026-01-10: React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to…
• CVE-2026-22029 - CVSS 8 (high), 2026-01-10: React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA…
• CVE-2026-21441 - CVSS 8.9 (high), 2026-01-07: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in…
• CVE-2025-69223 - CVSS 7.5 (high), 2026-01-05: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against…
• CVE-2025-2586 - CVSS 7.5 (high), 2025-03-31: A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints…
• CVE-2024-11831 - CVSS 5.4 (medium), 2025-02-10: A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such…