Veille CVE

Recherche « Red Hat Enterprise Linux AI (RHEL AI) 3 »

39 CVE

Critique 6 Élevée 24 Moyenne 9 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat Enterprise Linux AI (RHEL AI) 3 » ✕
  1. CVE-2026-87742 7.5 Élevée

    Red Hat build of Quarkus 3.27.5.SP2 · Red Hat build of Quarkus 3.33.3.SP2 · Red Hat Exploit Intelligence · Red Hat Enterprise Linux AI (RHEL AI) 3

    A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).

  2. CVE-2026-18393 5.4 Moyenne

    Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI)

    A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.

  3. CVE-2026-58049 8.6 Élevée

    FFmpeg · Red Hat Enterprise Linux AI 3.0 for RHEL 9 · Red Hat Enterprise Linux AI 3.2 for RHEL 9 · Red Hat Enterprise Linux AI 3.3 for RHEL 9

    FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.

  4. CVE-2026-48746 9.1 Critique

    vllm-project vllm · Red Hat AI Inference Server 3.2 · Red Hat AI Inference Server 3.3 · Red Hat Ansible Automation Platform 2.6

    vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.

  5. CVE-2026-56340 7.5 Élevée

    vLLM · Red Hat AI Inference Server · Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI)

    vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory corruption. This continues CVE-2025-62164, whose prior fix only disabled the feature by default rather than addressing the root cause.

  6. CVE-2026-12706 6.5 Moyenne

    Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI)

    A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).

  7. CVE-2026-8461 8.8 Élevée

    FFmpeg · Red Hat Enterprise Linux AI 3.5 for RHEL 9 · Red Hat AI Inference Server · Red Hat Enterprise Linux AI (RHEL AI) 3

    An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.

  8. CVE-2026-48818 7.5 Élevée

    Kludex starlette · Red Hat AI Inference Server 3.3 · Red Hat Exploit Intelligence · Red Hat Migration Toolkit for Applications 8

    Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.

  9. CVE-2026-12491 4.8 Moyenne

    vllm-project vLLM · Red Hat AI Inference Server · Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI)

    A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.

  10. CVE-2026-48043 7.5 Élevée

    netty · Red Hat Cryostat 4 on RHEL 9 · Red Hat AMQ Broker 7.14.1 · Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

    Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

  11. CVE-2026-45833 8.8 Élevée

    ChromaDB · Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI) · Trychroma chromadb

    A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.

  12. CVE-2026-45832 8.8 Élevée

    ChromaDB · Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI) · Trychroma chromadb

    All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

  13. CVE-2026-45830 8.8 Élevée

    ChromaDB · Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI) · Trychroma chromadb

    A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

  14. CVE-2026-46340 7.5 Élevée

    netty · Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 · Red Hat Data Grid 8.6.2 · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

    Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the `complete` flag can grow this structure indefinitely from tiny 1-byte DATA chunks. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

  15. CVE-2026-5497 7.5 Élevée

    vllm-project/vllm · Red Hat AI Inference Server · Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI)

    vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method splits the base64 data string on commas to extract individual JPEG frames without enforcing a frame count limit. An attacker can exploit this by crafting a single API request containing thousands of comma-separated base64-encoded JPEG frames in a data URL, causing the server to decode all frames into memory and crash due to excessive memory consumption. This vulnerability is reachable via the OpenAI-compatible chat completions API and does not require authentication.

  16. CVE-2026-5241 9.6 Critique

    huggingface/transformers · Red Hat OpenShift AI 2.25 · Red Hat OpenShift AI 3.3 · Red Hat OpenShift AI 3.4

    A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `LightGlueConfig` reads the `trust_remote_code` value from the untrusted `config.json` file and propagates it into nested `AutoConfig.from_pretrained()` calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.

  17. CVE-2026-49121 9.8 Critique

    ROCm aiter · Red Hat AI Inference Server · Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI)

    AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated remote attackers to execute arbitrary code by sending a malicious pickle payload to a ZMQ SUB socket with no authentication, HMAC, or format validation. Attackers who can reach the writer XPUB endpoint on the cluster network or supply a forged Handle with an attacker-controlled remote_subscribe_addr can deliver a crafted pickle payload that executes arbitrary code simultaneously as the inference worker process on every remote reader worker.

  18. CVE-2024-52011 8.3 Élevée

    vitejs launch-editor · vitejs vite · Red Hat Cluster Observability Operator 1.5.0 · Red Hat Cryostat 4

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

  19. CVE-2026-45292 5.3 Moyenne

    open-telemetry opentelemetry-java · io.opentelemetry opentelemetry-api · io.opentelemetry opentelemetry-extension-trace-propagators · Red Hat Data Grid 8.6.2

    opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.

  20. CVE-2026-48710 6.5 Moyenne Exploitée

    Kludex starlette · Red Hat AI Inference Server 3.3 · Red Hat Ansible Automation Platform 2.6 · Red Hat Ansible Automation Platform 2.7

    Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

  21. CVE-2026-45829 10.0 Critique

    ChromaDB · Red Hat Enterprise Linux AI (RHEL AI) 3

    A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

  22. CVE-2026-44513 8.8 Élevée

    huggingface diffusers · Red Hat OpenShift AI 3.4 · Red Hat AI Inference Server · Red Hat Enterprise Linux AI (RHEL AI) 3

    Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0.

  23. CVE-2026-44484 9.8 Critique

    Lightning-AI pytorch-lightning · Red Hat AI Inference Server · Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI)

    PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.

  24. CVE-2026-42561 7.5 Élevée

    Kludex python-multipart · Red Hat Ansible Automation Platform 2.6 · Red Hat Ansible Automation Platform 2.7 · Red Hat Migration Toolkit for Applications 8.2

    Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.

  25. CVE-2026-42579 9.1 Critique

    netty · Red Hat Cryostat 4 on RHEL 9 · Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 · Red Hat build of Quarkus 3.27.4

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

  26. CVE-2026-45109 7.5 Élevée

    vercel next.js · Red Hat Streams for Apache Kafka 2.9.4 · Red Hat Trusted Artifact Signer 1.3 · Red Hat Trusted Artifact Signer 1.4

    Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

  27. CVE-2026-44579 7.5 Élevée

    vercel next.js · Red Hat Streams for Apache Kafka 2.9.4 · Red Hat Trusted Artifact Signer 1.3 · Red Hat Trusted Artifact Signer 1.4

    Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.

  28. CVE-2026-44578 8.6 Élevée

    vercel next.js · Red Hat Streams for Apache Kafka 2.9.4 · Red Hat Trusted Artifact Signer 1.3 · Red Hat Trusted Artifact Signer 1.4

    Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

  29. CVE-2026-44577 5.9 Moyenne

    vercel next.js · Red Hat Streams for Apache Kafka 2.9.4 · Red Hat Trusted Artifact Signer 1.3 · Red Hat Trusted Artifact Signer 1.4

    Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.

  30. CVE-2026-44575 7.5 Élevée

    vercel next.js · Red Hat Streams for Apache Kafka 2.9.4 · Red Hat Trusted Artifact Signer 1.3 · Red Hat Trusted Artifact Signer 1.4

    Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.

  31. CVE-2026-44574 8.1 Élevée

    vercel next.js · Red Hat Streams for Apache Kafka 2.9.4 · Red Hat Trusted Artifact Signer 1.3 · Red Hat Trusted Artifact Signer 1.4

    Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.

  32. CVE-2026-44573 7.5 Élevée

    vercel next.js · Red Hat Streams for Apache Kafka 2.9.4 · Red Hat Trusted Artifact Signer 1.3 · Red Hat Trusted Artifact Signer 1.4

    Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.

  33. CVE-2026-44293 8.8 Élevée

    protobufjs protobuf.js · Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Red Hat Enterprise Linux 10 · Red Hat Ansible Automation Platform 2.6

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.

  34. CVE-2026-44289 7.5 Élevée

    protobufjs protobuf.js · Red Hat Ansible Automation Platform 2.2 · Red Hat OpenShift AI 3.4 · Red Hat OpenShift Pipelines

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

  35. CVE-2026-43868 5.3 Moyenne

    Apache Software Foundation Apache Thrift · Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 · Red Hat OpenShift AI 2.25 · Red Hat AI Inference Server

    Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

  36. CVE-2026-41607 6.5 Moyenne

    Apache Software Foundation Apache Thrift · Red Hat Multicluster Global Hub 1.3.4 · Red Hat Multicluster Global Hub 1.4.5 · Red Hat Multicluster Global Hub 1.6.5

    Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

  37. CVE-2026-41606 5.3 Moyenne

    Apache Software Foundation Apache Thrift · Red Hat Multicluster Global Hub 1.3.4 · Red Hat Multicluster Global Hub 1.4.5 · Red Hat Multicluster Global Hub 1.6.5

    Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

  38. CVE-2026-41605 7.3 Élevée

    Apache Software Foundation Apache Thrift · Red Hat Multicluster Global Hub 1.3.4 · Red Hat Multicluster Global Hub 1.4.5 · Red Hat Multicluster Global Hub 1.6.5

    Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

  39. CVE-2026-41604 8.2 Élevée

    Apache Software Foundation Apache Thrift · Red Hat Multicluster Global Hub 1.3.4 · Red Hat Multicluster Global Hub 1.4.5 · Red Hat Multicluster Global Hub 1.6.5

    Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.