Skip to contentRed Hat Offline Knowledge Portal vulnerabilities
- fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 morejackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54513Fix available8.1 High
- io.opentelemetry opentelemetry-api, opentelemetry-extension-trace-propagators, open-telemetry opentelemetry-java +17 more +19 moreopentelemetry-java: Unbounded Memory Allocation in W3C Baggage PropagationCVE-2026-45292Fix available5.3 Medium
- apache httpclient, red hat cryostat 4, migration toolkit for applications 8 +45 more +47 moreApache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verificationCVE-2026-40542Fix available7.3 High
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +39 more +41 moreHTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-2332Public exploitFix available7.4 High
- eclipse jetty, red hat hawtio hawtio 4.4.0, build of apache camel 4.18.1 for spring boot 3.5.14 +6 more +8 moreDuplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variablesCVE-2026-5795Fix available7.4 High
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 moreApache ZooKeeper: Sensitive information disclosure in client configuration handlingCVE-2026-24308Fix available7.5 High
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 moreApache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManagerCVE-2026-24281Fix available7.4 High
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +35 more +37 moreThe Eclipse Jetty Server Artifact has a Gzip request memory leakCVE-2026-1605Fix available7.5 High
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty's wrapping plain trust manager silently disables hostname verificationCVE-2026-50010Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesCVE-2026-45416Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingCVE-2026-44249Fix available8.1 High