Loading story…
Red Hat issued security updates for OpenShift and related products to remediate CVE-2024-45296 in path-to-regexp and CVE-2024-43796 in Express.js. The path-to-regexp flaw permits regular-expression denial of service when a crafted route pattern places two parameters in one path segment separated by a non-period character, potentially blocking Node.js's single-threaded event loop. Express versions before 4.20.0 can improperly handle untrusted input passed to response.redirect(), potentially enabling execution of untrusted code even when the input has been sanitized.
Affected updates include OpenShift Data Foundation 4.14.13, 4.15.9, and 4.17.0 container images, as well as OpenShift Container Platform 4.17 releases and other Red Hat offerings such as OpenShift Service Mesh, Serverless, OpenShift AI, Dev Spaces, Network Observability, and the Red Hat build of Apache Camel. The advisories also address additional bundled-component flaws, including prototype pollution, unsafe redirects, DOM clobbering, resource exhaustion, and potential code execution. Administrators should apply the applicable Red Hat errata and upgrade path-to-regexp to 0.1.10 on the 0.1 branch or 8.0.0 on other branches, and Express to 4.20.0 or later.
See real exploitation activity before you spend the cycle.
18 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated RHSA-2025:1051 for OpenShift Service Mesh Containers 2.5.8 on RHEL 8. The update remediates CVE-2024-52798 in path-to-regexp, CVE-2024-55565 in nanoid, and CVE-2024-45338 in golang.org/x/net/html across affected architectures.
Red Hat issued Important-rated RHSA-2025:0875 and released OpenShift Container Platform 4.17.15, fixing CVE-2024-43796 and CVE-2024-45296 along with other third-party component vulnerabilities.
RHSA-2025:0164 supplied updated OpenShift Data Foundation 4.15.9 container images for RHEL 9 that fix CVE-2024-43796 and the path-to-regexp ReDoS vulnerability CVE-2024-45296.
Red Hat issued RHSA-2024:11023 for HawtIO 4.1.0 in Red Hat build of Apache Camel 4, addressing CVE-2024-43796 and CVE-2024-45296 among nine vulnerabilities.
Red Hat issued RHSA-2024:8676 with updated OpenShift Data Foundation 4.17.0 images for RHEL 9, remediating CVE-2024-43796 in Express redirects and CVE-2024-45296 in path-to-regexp.
Red Hat issued RHSA-2024:7922 for OpenShift Container Platform 4.17.1, including a fix for CVE-2024-45296, a path-to-regexp regular-expression backtracking denial-of-service flaw.
Red Hat Bugzilla record 2324550 tracks CVE-2024-21538, a regular-expression denial-of-service vulnerability in cross-spawn.
Red Hat identified RHSA-2025:0079 for CVE-2024-43796 in RHODF 4.17, RHSA-2025:0082 for both vulnerabilities in RHODF 4.16, and RHSA-2025:0664 for CVE-2024-45296 in RHOSS 1.35.
RHSA-2024:10906 addressed CVE-2024-43796 and CVE-2024-45296 in Red Hat Migration Toolkit for Containers 1.8.
Red Hat addressed CVE-2024-45296 in Red Hat Ansible Automation Platform 2.4 for RHEL 8 and RHEL 9 through RHSA-2024:10762.
Red Hat addressed CVE-2024-45296 in Red Hat OpenShift Dev Spaces 3 Containers through RHSA-2024:10236.
Red Hat issued RHSA-2024:8023 to address CVE-2024-43796 in RHOSS-1.34-RHEL-8.
RHSA-2024:8014 addressed CVE-2024-43796 and CVE-2024-45296 in Network Observability 1.7.0 for RHEL 9.
Red Hat addressed CVE-2024-45296 in OpenShift Container Platform 4.16 through RHSA-2024:7599.
Red Hat issued RHSA-2024:7726 to address CVE-2024-43796 and CVE-2024-45296 in OpenShift Service Mesh 2.6 for RHEL 8 and RHEL 9.
Express versions earlier than 4.20.0 can execute untrusted code when untrusted input is passed to response.redirect(), including in some cases where the input was sanitized; Express 4.20.0 patches CVE-2024-43796.
The path-to-regexp flaw occurs when two parameters in one path segment are separated by a non-period character, enabling an inefficient regular expression to block JavaScript's main event loop. Users of the 0.1 line were directed to upgrade to 0.1.10, while other users were directed to upgrade to 8.0.0.
Red Hat issued RHSA-2025:0323 with refreshed OpenShift Data Foundation 4.14.13 images for RHEL 9, remediating CVE-2024-43796 and CVE-2024-45296.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
15 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released security updates for multiple products to remediate **CVE-2024-28849** in the Node.js `follow-redirects` package. The flaw allows the `Proxy-Authorization` header to persist during a cross-domain redirect even when `Authorization` is removed, potentially exposing proxy-authentication credentials to the redirected destination. The issue is fixed in `follow-redirects` version 1.15.6; Red Hat states that upgrading is the only mitigation. Affected advisories include Migration Toolkit for Applications 7.0.3 container images (`RHSA-2024:3316`), Network Observability 1.6.0 for Red Hat OpenShift (`RHSA-2024:3868`), and Red Hat Ansible Automation Platform 2.4 (`RHSA-2024:3781`). The updates also address additional bundled-component vulnerabilities, including denial-of-service, file-disclosure, certificate-validation, request-smuggling, and arbitrary-code-execution issues; organizations should apply the relevant updates across supported RHEL and OpenShift deployments.
Aug 27, 2026
Red Hat released Important security updates for **OpenShift Service Mesh Containers** 2.5.5 and 2.6.2 and **OpenShift Serverless Logic** 1.34.0, remediating flaws in bundled Node.js and infrastructure components. The updates address **CVE-2024-43799** in the `send` library, where untrusted input passed to `SendStream.redirect()` can result in untrusted code execution, and **CVE-2024-43788** in Webpack's `AutoPublicPathRuntimeModule`, a DOM-clobbering flaw that can enable XSS when attackers can inject insufficiently sanitized scriptless HTML elements with `name` or `id` attributes. The Service Mesh advisories also fix issues in `serve-static`, Express, `body-parser`, Envoy, `path-to-regexp`, and libcurl, including denial-of-service conditions, unsafe redirects, regular-expression DoS, log injection, externally manipulable `x-envoy` headers, Envoy crashes, and a libcurl ASN.1 date-parser overread. The Serverless Logic update additionally addresses axios SSRF and input-sanitization issues and an unbounded Vert.x gRPC message-size condition. Affected deployments span RHEL 8 on x86_64, ARM64/aarch64, ppc64le, and s390x where applicable; Red Hat recommends applying relevant prior errata before deploying the updates.
Aug 26, 2026
Red Hat released **Important** updates for Red Hat OpenShift Data Foundation (ODF) 4.14.18 and 4.15.14 on Red Hat Enterprise Linux 9, delivering refreshed container images and upgrading Ceph to `RHCEPH-7.1z4`. The updates affect x86_64, aarch64, ppc64le, and s390x deployments and also resolve an `MDSCacheUsageHigh` alert issue in the 4.15 stream. The releases remediate vulnerabilities in bundled dependencies, including `CVE-2024-39249`, a regular-expression denial-of-service flaw in Node.js `async` autoinject; `CVE-2024-29041`, which can let malformed URLs bypass Express redirect allowlists; and `CVE-2024-29180`, a webpack-dev-middleware path-traversal issue that could disclose files. The advisories also address cross-site scripting, prototype-pollution, file-disclosure, and additional denial-of-service and memory-consumption flaws; Red Hat advises customers to apply applicable prior errata before upgrading.
Aug 27, 2026