RHSA-2026:34608 Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update
jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression lodash: prototype pollution in _.unset and _.omit functions netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files lodash: lodash: Arbitrary code execution via untrusted input in template imports eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name react-server-dom-webpack: react-server-dom-parcel: reactreact-server-dom-turbopack: React Server Components: Denial of Service via specially crafted HTTP requests Apache ZooKeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n Next.js: Next.js: Authorization bypass via crafted query parameters next.js: Next.js: Unauthorized access to protected content via middleware bypass Next.js: Next.js: Denial of Service via Image Optimization API Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests next.js: Next.js: Denial of Service via crafted POST requests to server actions netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters
CVSS v3.1 score: 7.5