Service Registry (Redhat) - vulnerabilities (CVEs)

60 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-05-13. Vendor: Redhat.

CVEs of Service Registry

CVE-2026-42587 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation…
CVE-2026-42584 - CVSS 9.1 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response…
CVE-2026-42581 - CVSS 9.8 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting…
CVE-2026-42579 - CVSS 9.1 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035…
CVE-2026-42578 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP…
CVE-2026-42264 - CVSS 9.1 (critical), 2026-05-08: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL,…
CVE-2026-33811 - CVSS 7.5 (high), 2026-05-07: When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
CVE-2026-39852 - CVSS 8.8 (high), 2026-05-05: Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path…
CVE-2026-42044 - CVSS 9.1 (critical), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution…
CVE-2026-42043 - CVSS 10 (critical), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request…
CVE-2026-42041 - CVSS 8.2 (high), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution…
CVE-2026-42039 - CVSS 7.5 (high), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit,…
CVE-2026-42033 - CVSS 7.4 (high), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency…
CVE-2026-40542 - CVSS 7.3 (high), 2026-04-22: Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper…
CVE-2026-40895 - CVSS 7.5 (high), 2026-04-21: follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an…
CVE-2026-33557 - CVSS 9.1 (critical), 2026-04-20: A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to…
CVE-2026-2332 - CVSS 9.1 (critical), 2026-04-14: In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined…
CVE-2026-40175 - CVSS 8.1 (high), 2026-04-10: Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in…
CVE-2025-62718 - CVSS 9.9 (critical), 2026-04-09: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when…
CVE-2026-32283 - CVSS 7.5 (high), 2026-04-08: If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled…
CVE-2026-4800 - CVSS 9.8 (critical), 2026-03-31: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both…
CVE-2026-33896 - CVSS 9.1 (critical), 2026-03-27: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()`…
CVE-2026-33895 - CVSS 7.5 (high), 2026-03-27: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification…
CVE-2026-33891 - CVSS 7.5 (high), 2026-03-27: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS)…
CVE-2026-33894 - CVSS 7.5 (high), 2026-03-27: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature…
CVE-2026-33871 - CVSS 8.7 (high), 2026-03-27: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial…
CVE-2026-33870 - CVSS 7.5 (high), 2026-03-27: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted…
CVE-2026-4926 - CVSS 7.5 (high), 2026-03-26: Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated…
CVE-2025-67030 - CVSS 8.8 (high), 2026-03-25: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before…
CVE-2026-33228 - CVSS 9.8 (critical), 2026-03-20: flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as…
CVE-2026-32141 - CVSS 7.5 (high), 2026-03-12: flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized…
CVE-2026-29063 - CVSS 9.8 (critical), 2026-03-06: Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via…
CVE-2026-29074 - CVSS 7.5 (high), 2026-03-06: SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from…
CVE-2026-1605 - CVSS 7.5 (high), 2026-03-05: In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding:…
CVE-2025-69873 - CVSS 7.5 (high), 2026-02-11: ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern…
CVE-2026-25639 - CVSS 7.5 (high), 2026-02-09: Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a…
CVE-2024-4027 - CVSS 7.5 (high), 2026-01-30: A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client…
CVE-2025-13465 - CVSS 8.2 (high), 2026-01-21: The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from…
CVE-2026-22029 - CVSS 8 (high), 2026-01-10: React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA…
CVE-2025-61686 - CVSS 9.1 (critical), 2026-01-10: React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to…
CVE-2024-3884 - CVSS 7.5 (high), 2025-12-03: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel)…
CVE-2025-7195 - CVSS 6.4 (medium), 2025-08-07: Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before…
CVE-2025-2240 - CVSS 7.5 (high), 2025-03-12: A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when…
CVE-2024-11831 - CVSS 5.4 (medium), 2025-02-10: A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such…
CVE-2024-12397 - CVSS 7.4 (high), 2024-12-12: A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an…
CVE-2023-4639 - CVSS 7.4 (high), 2024-11-17: A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an…
CVE-2024-3653 - CVSS 5.3 (medium), 2024-07-08: A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving…
CVE-2023-6717 - CVSS 6 (medium), 2024-04-25: A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer…
CVE-2023-5675 - CVSS 6.5 (medium), 2024-04-25: A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by…
CVE-2024-1249 - CVSS 7.4 (high), 2024-04-17: A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to…
CVE-2024-1132 - CVSS 8.1 (high), 2024-04-17: A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious…
CVE-2024-1300 - CVSS 5.4 (medium), 2024-04-02: A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server…
CVE-2024-1023 - CVSS 6.5 (medium), 2024-03-27: A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP…
CVE-2024-1635 - CVSS 7.5 (high), 2024-02-19: A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and…
CVE-2023-1584 - CVSS 7.5 (high), 2023-10-04: A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can…
CVE-2023-3223 - CVSS 7.5 (high), 2023-09-27: A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow…
CVE-2022-4245 - CVSS 4.3 (medium), 2023-09-25: A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue…
CVE-2022-4244 - CVSS 7.5 (high), 2023-09-25: A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the…
CVE-2023-4853 - CVSS 8.1 (high), 2023-09-20: A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in…
CVE-2023-1108 - CVSS 7.5 (high), 2023-09-14: A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the…