Veille CVE

Semaine du 11 mai au 17 mai 2026

3 CVE

Critique 0 Élevée 2 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat OpenShift Service Mesh 3 » ✕
  1. CVE-2026-44293 8.8 Élevée

    protobufjs protobuf.js · Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Red Hat Enterprise Linux 10 · Red Hat Ansible Automation Platform 2.6

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.

  2. CVE-2026-44289 7.5 Élevée

    protobufjs protobuf.js · Red Hat Ansible Automation Platform 2.2 · Red Hat OpenShift AI 3.4 · Red Hat OpenShift Pipelines

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

  3. CVE-2026-42338 6.1 Moyenne

    beaugunderson ip-address · Red Hat AMQ Broker 7.13.6 · Red Hat AMQ Broker 7.14.1 · Red Hat Enterprise Linux 10

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.