Skip to contentRed Hat Openshift Developer Tools And Services vulnerabilities
- jenkins script security, jenkins project script security plugin, red hat openshift developer tools and services +11 more +13 moreJenkins Script Security Plugin has a script security bypass vulnerabilityCVE-2026-57281Fix available7.5 High
- fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 morejackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54513Fix available8.1 High
- jenkins, red hat openshift developer tools and services 4.12, openshift developer tools and services 4.13 +9 more +11 moreJenkins Open Redirect Through Newline/Tab Characters in Redirect URLCVE-2026-53437Fix available4.3 Medium
- jenkins, red hat openshift developer tools and services 4.12, openshift developer tools and services 4.13 +9 more +11 moreJenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonationCVE-2026-53435Public exploitFix availableEPSS 51.2%8.8 High
- go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 moreInefficient candidate hostname parsing in crypto/x509CVE-2026-27145Public exploitFix available6.5 Medium
- docker engine, moby docker engine, docker docker/daemon +20 more +22 moreDocker: `PUT /containers/{id}/archive` executes container binary on the hostCVE-2026-41567Public exploitFix available7.2 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- go standard library net/http, golang go, http2 +106 more +108 moreInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814Fix available7.5 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- apache httpclient, red hat cryostat 4, migration toolkit for applications 8 +45 more +47 moreApache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verificationCVE-2026-40542Fix available7.3 High
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreervlet Path Not Correctly Included in Path Matching of XML Authorization RulesCVE-2026-22754Fix available7.5 High
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreUnauthorized User Impersonation when Using X.509 Client CertificatesCVE-2026-22747Public exploitFix available6.8 Medium
- legion of the bouncy castle inc. bc-java, red hat openshift developer tools and services, openshift developer tools and services 4.12 +30 more +32 moreUnbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.CVE-2026-3505Fix available8.7 High
- legion of the bouncy castle inc. bc-java, bcpix-lts, bcpkix-fips +43 more +45 morePKIX draft CompositeVerifier accepts empty signature sequence as valid.CVE-2026-5588Fix available6.3 Medium
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +29 more +31 moreNon-constant time comparisons risk private key leakage in FrodoKEM.CVE-2026-5598Fix available8.9 High
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +42 more +44 moreLDAP Injection Vulnerability in LDAPStoreHelper.javaCVE-2026-0636Fix available5.5 Medium
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +44 more +46 moreGOSTCTR implementation unable to process more than 255 blocks correctlyCVE-2025-14813Fix available9.3 Critical
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +39 more +41 moreHTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-2332Public exploitFix available7.4 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 moreCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509CVE-2026-33810Fix available8.2 High
- go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 moreUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x509CVE-2026-32280Fix available7.5 High
- go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 moreGo JOSE affect by a panic in JWE decryptionCVE-2026-34986Fix available7.5 High
- codehaus-plexus plexus-utils, red hat cryostat 4, openshift developer tools and services +49 more +51 morePlexus-Utils has a Directory Traversal vulnerability in its extractFile methodCVE-2025-67030Fix available8.8 High
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 moregRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186Public exploitFix available9.1 Critical
- jenkins, red hat openshift developer tools and services 4.12, openshift developer tools and services 4.13 +9 more +11 moreJenkins has a link following vulnerability allows arbitrary file creationCVE-2026-33001Fix available8.8 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 moreIncorrect parsing of IPv6 host literals in net/urlCVE-2026-25679Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +99 more +101 moreIncorrect enforcement of email constraints in crypto/x509CVE-2026-27137Fix available7.5 High
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +35 more +37 moreThe Eclipse Jetty Server Artifact has a Gzip request memory leakCVE-2026-1605Fix available7.5 High
- dabeaz ply, red hat fence agents remediation operator, migration toolkit for containers +25 more +27 moreAn undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code...CVE-2025-56005Public exploitFix availableDisputedEPSS 18.8%9.8 Critical
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- jenkins, jenkins openshift-sync-plugin, red hat openshift developer tools and services +2 moreJenkins-image: sensitive data disclosure when using openshift jenkins imageCVE-2024-94536.5 Medium
- red hat openshift developer tools and services, enterprise linux 10, enterprise linux 8 +25 more +27 morePodman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)CVE-2024-9676Fix available6.5 Medium
- buildah project buildah, red hat openshift developer tools and services, enterprise linux 10 +30 more +32 moreBuildah: buildah allows arbitrary directory mountCVE-2024-9675Fix available7.8 High
- red hat nbde tang server, openshift developer tools and services, openshift pipelines +34 more +36 moreGolang-fips: golang fips zeroed bufferCVE-2024-9355Fix available6.5 Medium
- red hat multicluster engine for kubernetes, oadp-1.3-rhel-9, openshift developer tools and services +28 more +30 moreContainers/image: digest type does not guarantee valid typeCVE-2024-3727Fix available8.3 High
- red hat nbde tang server, openshift developer tools and services, openshift pipelines +32 more +34 moreGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsCVE-2024-1394Fix available7.5 High
- devfile registry-support, red hat openshift developer tools and services, openshift container platform 4 +1 more +3 moreRegistry-support: decompress can delete files outside scope via relative pathsCVE-2024-1485Fix available8.0 High
- linuxfoundation runc, fedoraproject fedora, red hat ocp-tools-4.15-rhel-8 +26 more +28 morerunc container breakout through process.cwd trickery and leaked fdsCVE-2024-21626Public exploitFix availableEPSS 18.9%8.6 High
- golang net, golang.org/x/net golang.org/x/net/idna, go standard library net/http +147 more +149 moreInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821Fix available9.6 Critical