Loading story…
Red Hat released Important security updates for OpenShift Service Mesh Containers 2.5.5 and 2.6.2 and OpenShift Serverless Logic 1.34.0, remediating flaws in bundled Node.js and infrastructure components. The updates address CVE-2024-43799 in the send library, where untrusted input passed to SendStream.redirect() can result in untrusted code execution, and CVE-2024-43788 in Webpack's AutoPublicPathRuntimeModule, a DOM-clobbering flaw that can enable XSS when attackers can inject insufficiently sanitized scriptless HTML elements with name or id attributes.
The Service Mesh advisories also fix issues in serve-static, Express, body-parser, Envoy, path-to-regexp, and libcurl, including denial-of-service conditions, unsafe redirects, regular-expression DoS, log injection, externally manipulable x-envoy headers, Envoy crashes, and a libcurl ASN.1 date-parser overread. The Serverless Logic update additionally addresses axios SSRF and input-sanitization issues and an unbounded Vert.x gRPC message-size condition. Affected deployments span RHEL 8 on x86_64, ARM64/aarch64, ppc64le, and s390x where applicable; Red Hat recommends applying relevant prior errata before deploying the updates.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2024:8023, releasing OpenShift Serverless Logic 1.34.0 for affected RHEL 8 architectures. The update addressed CVE-2024-43799 and CVE-2024-43788 as well as axios, Express, Vert.x gRPC, and serve-static vulnerabilities.
Red Hat issued Moderate advisory RHSA-2024:7706 for the Red Hat build of Cryostat 3 on RHEL 8. The update fixes webpack DOM-clobbering flaw CVE-2024-43788 and DOMPurify prototype-pollution XSS vulnerability CVE-2024-45801.
Red Hat issued Important advisory RHSA-2024:7724 for OpenShift Service Mesh Containers 2.4.11. The update remediated Envoy, webpack, send, and serve-static flaws, including CVE-2024-43788, CVE-2024-43799, CVE-2024-32475, CVE-2024-32976, and CVE-2024-43800.
Red Hat issued Important advisory RHSA-2024:7726 for OpenShift Service Mesh Containers 2.6.2. The update remediated the send code-execution flaw, webpack DOM-clobbering flaw, and additional issues affecting serve-static, Express, path-to-regexp, body-parser, Envoy, and libcurl.
Red Hat issued Important advisory RHSA-2024:7725 for OpenShift Service Mesh Containers 2.5.5, addressing CVE-2024-43799 and CVE-2024-43788 along with vulnerabilities in serve-static, Envoy, and body-parser.
Red Hat issued advisories addressing DOMPurify prototype-pollution XSS vulnerability CVE-2024-45801 in Network Observability, Ansible Automation Platform, OpenShift Dev Spaces, and OpenShift Container Platform. The flaw can let specially nested malicious HTML bypass DOMPurify depth checks, and is fixed upstream in versions 2.5.4 and 3.1.3.
Red Hat issued advisories remediating CVE-2024-43800 in Network Observability, OpenShift Data Foundation, Migration Toolkit for Containers, HawtIO, and OpenShift Container Platform. The fixes address serve-static passing sanitized but untrusted input to redirect(), which could allow execution of untrusted code.
Webpack fixed CVE-2024-43788, a DOM-clobbering issue in AutoPublicPathRuntimeModule, in version 5.94.0. The gadget had been observed enabling XSS in Canvas LMS when attacker-controlled scriptless HTML was insufficiently sanitized.
The Node.js send library patched CVE-2024-43799 in version 0.19.0. The flaw involved untrusted input being passed to SendStream.redirect(), potentially enabling execution of untrusted code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released security updates across **OpenShift Container Platform**, OpenShift Data Foundation, OpenShift Serverless, distributed tracing, and the Red Hat build of Cryostat. The updates remediate vulnerabilities in shared Go, OpenSSH, networking, image-handling, and third-party libraries that could enable denial of service, resource exhaustion, memory leakage, sensitive-information exposure, or improper privilege propagation. Affected deployments span RHEL 8 and RHEL 9 and supported x86_64, ARM64, IBM Power, and IBM Z/LinuxONE architectures. Notable fixes include **CVE-2023-48795** (Terrapin), which permits an active attacker to truncate initial SSH secure-channel messages under vulnerable ChaCha20-Poly1305 or Encrypt-then-MAC configurations, and **CVE-2024-1394**, an RSA error-path memory leak in `golang-fips/openssl` that can cause resource exhaustion. OpenShift Container Platform updates also address a possible OpenSSH remote-code-execution condition on RHEL 9 associated with a signal-handling race. Red Hat advised customers to install relevant prior errata and upgrade clusters and operators through their supported release channels; temporary Terrapin mitigations include disabling `chacha20-poly1305` and EtM MAC algorithms where updates cannot be deployed immediately.
Aug 27, 2026
Red Hat issued security updates for OpenShift and related products to remediate **CVE-2024-45296** in `path-to-regexp` and **CVE-2024-43796** in Express.js. The `path-to-regexp` flaw permits regular-expression denial of service when a crafted route pattern places two parameters in one path segment separated by a non-period character, potentially blocking Node.js's single-threaded event loop. Express versions before 4.20.0 can improperly handle untrusted input passed to `response.redirect()`, potentially enabling execution of untrusted code even when the input has been sanitized. Affected updates include OpenShift Data Foundation 4.14.13, 4.15.9, and 4.17.0 container images, as well as OpenShift Container Platform 4.17 releases and other Red Hat offerings such as OpenShift Service Mesh, Serverless, OpenShift AI, Dev Spaces, Network Observability, and the Red Hat build of Apache Camel. The advisories also address additional bundled-component flaws, including prototype pollution, unsafe redirects, DOM clobbering, resource exhaustion, and potential code execution. Administrators should apply the applicable Red Hat errata and upgrade `path-to-regexp` to 0.1.10 on the 0.1 branch or 8.0.0 on other branches, and Express to 4.20.0 or later.
Aug 27, 2026
Red Hat released a series of OpenShift Container Platform security updates across supported branches, including **4.13.68**, **4.15.66**, **4.16.64**, **4.18.44**, and **4.19.33**, to remediate vulnerabilities in bundled components and container images. The advisories cover deployments on **RHEL 8** and **RHEL 9** across `x86_64`, `s390x`, `ppc64le`, and `aarch64`, and Red Hat urged customers to upgrade through the appropriate release channel using the OpenShift CLI or web console. The fixes address multiple privilege-escalation and memory-safety issues, notably **CVE-2026-4878** in `libcap`, a TOCTOU race in `cap_set_file()` that can let an attacker influence capability assignment and gain root privileges, and **CVE-2026-35385** in OpenSSH, where use of legacy `scp` with `-O` by root without `-p` can unexpectedly preserve `setuid` or `setgid` bits on downloaded files. Additional patched issues include Linux kernel flaws such as **CVE-2026-43037**, **CVE-2026-46300**, **CVE-2026-46243**, and **CVE-2026-46331`, along with vulnerabilities in `jq` and `rsync`, ranging from denial of service and out-of-bounds reads to local privilege escalation.
Aug 25, 2026