RHSA-2026:34342 Red Hat Security Advisory: Cluster Observability Operator 1.5.0
nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function nodejs-trim-newlines: ReDoS in .end() method braces: fails to limit the number of characters it can handle golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html launch-editor: vite: launch-editor: Arbitrary command execution via insufficient file argument sanitization golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html golang.org/x/net/html: Infinite parsing loop in golang.org/x/net undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: undici: Denial of Service via crafted WebSocket frame with large length undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter lodash: lodash: Arbitrary code execution via untrusted input in template imports path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handling undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy form-data: form-data: Form field override via CRLF injection undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution flatted: flatted: Unbounded recursion DoS in parse() revive phase flatted: Flatted: Prototype pollution vulnerability allows arbitrary code execution via crafted JSON. picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance handlebars.js: Handlebars: Remote Code Execution via crafted Abstract Syntax Tree object in compile() handlebars: Handlebars: Arbitrary code execution via @partial-block overwrite handlebars.js: Handlebars.js: Denial of Service via malformed decorator syntax in template compilation handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context handlebars.js: Handlebars: Arbitrary code execution via CLI precompiler input sanitization flaw golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
CVSS v3.1 score: 7.5