Loading story…
Red Hat released Important-rated updates for Advanced Cluster Management for Kubernetes 2.11.5 and Multicluster Engine for Kubernetes 2.6.5 that remediate CVE-2024-55565, a Nano ID (nanoid) flaw caused by mishandling non-integer values. The releases also address CVE-2024-45337 in golang.org/x/crypto/ssh and CVE-2024-45338 in golang.org/x/net/html, delivering refreshed container images for supported RHEL 9 deployments across x86_64, ARM64, IBM Power, and IBM Z/LinuxONE architectures.
Affected Nano ID versions prior to 5.0.9—including the vulnerable 3.x line before 3.3.8—should be replaced with fixed builds. Red Hat has issued related errata for OpenShift, OpenShift AI, Ansible Automation Platform, OpenShift Dev Spaces, OpenShift Service Mesh, and Kubernetes management products; administrators should apply prerequisite errata where specified and upgrade through the applicable Red Hat release channels and installation guidance.
See real exploitation activity before you spend the cycle.
16 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated RHSA-2025:1116 for OpenShift Container Platform 4.13.55. The release updated container images to remediate five vulnerabilities, including Go HTTP/2 denial-of-service flaws, a Python tempfile path-traversal issue, and sensitive-URL logging in go-retryablehttp.
Red Hat released RHSA-2025:1331, RHSA-2025:1332, and RHSA-2025:1333 to remediate CVE-2024-45337 in affected Gatekeeper 3.17, 3.15, and 3.14 components for RHEL 9.
Red Hat recorded CVE-2024-45337, an authorization-bypass issue in golang.org/x/crypto/ssh caused by unsafe use of ServerConfig.PublicKeyCallback. The issue is fixed in golang.org/x/crypto v0.31.0.
Red Hat addressed CVE-2024-55565 in RHODF 4.18 for RHEL 9 through RHSA-2025:2652.
Red Hat addressed CVE-2024-55565 in OpenShift Service Mesh 2.5 for RHEL 8 through RHSA-2025:1051.
Red Hat addressed CVE-2024-55565 in OpenShift Dev Spaces 3 Containers through RHSA-2025:0892.
Red Hat addressed CVE-2024-55565 in Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 through RHSA-2025:0851.
Red Hat issued RHSA-2025:0875 to address CVE-2024-55565 in OpenShift Container Platform 4.17.
Red Hat issued Important-rated RHSA-2025:0785 for Advanced Cluster Management for Kubernetes 2.11.5 GA images on RHEL 9 x86_64. It fixed CVE-2024-55565, CVE-2024-45337, and CVE-2024-45338.
Red Hat issued Important-rated RHSA-2025:0778 for Multicluster Engine for Kubernetes 2.6.5 GA images. The update remediated CVE-2024-55565 as well as CVE-2024-45337 and CVE-2024-45338.
Red Hat addressed CVE-2024-55565 in Multicluster Engine for Kubernetes 2.7 for RHEL 8 and RHEL 9 through RHSA-2025:0723.
Red Hat addressed CVE-2024-55565 in OpenShift Container Platform 4.17 through RHSA-2025:0654.
Red Hat addressed CVE-2024-55565 in Ansible Automation Platform 2.5 for RHEL 8 and RHEL 9 through RHSA-2025:0340.
Red Hat addressed CVE-2024-55565 in Red Hat OpenShift AI/RHODF 4.16 for RHEL 9 through RHSA-2025:0082.
Red Hat addressed CVE-2024-55565 in Red Hat OpenShift AI/RHODF 4.17 for RHEL 9 through RHSA-2025:0079.
The nanoid issue, tracked as CVE-2024-55565, was reported upstream through JupyterLab issue 17056. nanoid versions before 5.0.9 mishandle non-integer values; version 3.3.8 is also identified as fixed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released container-image and platform updates across its Kubernetes portfolio to remediate vulnerabilities in Go dependencies, chiefly **CVE-2024-45337** in `golang.org/x/crypto/ssh` and **CVE-2024-45338** in `golang.org/x/net/html`. The SSH issue can enable authorization bypass when applications misuse `ssh.ServerConfig.PublicKeyCallback`; the HTML flaw involves non-linear parsing of case-insensitive content. Affected products include OpenShift Container Platform 4.15 and 4.18, Advanced Cluster Management 2.9.6, Multicluster Global Hub 1.2 and 1.3, Gatekeeper 3.14 and 3.15, OpenShift Data Foundation 4.15, VolSync 0.10 and 0.11, and Advanced Cluster Security (RHACS) 4.4 and 4.5. Several releases also address **CVE-2024-53259**, a `quic-go` denial-of-service flaw in which forged ICMP Packet Too Large messages can disrupt established QUIC connections, and RHACS 4.6.2 fixes `go-git` argument injection (**CVE-2025-21613**) and malicious Git-server reply denial of service (**CVE-2025-21614**). Red Hat recommends upgrading affected platforms and container images through their supported release channels, including deployments on x86_64, aarch64, ppc64le, and s390x where applicable; RHACS customers should move to 4.4.8, 4.5.6, or 4.6.2 according to their release stream.
Aug 27, 2026
Red Hat released fixes for **CVE-2024-3727**, a flaw in the widely used `github.com/opencontainers/go-digest` library in which digest values may not be correctly validated. The weakness can allow unexpected authenticated access to container registries using a victim’s credentials, resource exhaustion, local path traversal, and potentially additional attacks. Red Hat tracked the issue across container-related packages and issued updates for affected OpenShift, Enterprise Linux, Advanced Cluster Security, and related offerings. The remediation was included in OpenShift Container Platform updates 4.14.34, 4.15.24, 4.16.14, and 4.16.15, as well as Migration Toolkit for Containers 1.8.4. Affected organizations should upgrade clusters and MTC deployments through their supported release channels, using the OpenShift CLI or web console where applicable; the OpenShift updates are available across supported x86_64, s390x, ppc64le, and aarch64 environments.
Aug 27, 2026
Red Hat's Multicluster Engine for Kubernetes 2.5.2 release images remediate two moderate-severity third-party vulnerabilities: `CVE-2024-28176` in Jose and `CVE-2024-21501` in `sanitize-html`. RHBA-2024:1775 supplies refreshed images for aarch64, ppc64le, s390x, and x86_64 deployments and also affects related Red Hat Advanced Cluster Management and OpenShift Container Platform components. `CVE-2024-28176` can cause excessive CPU or memory consumption during JWE decryption, creating a denial-of-service condition (CVSS 5.3). `CVE-2024-21501` can allow an unauthenticated network attacker to enumerate server-side files and dependencies when `sanitize-html` permits the `style` attribute, exposing filesystem-layout information (CVSS 5.3); Red Hat Developer Hub remained listed as affected.
Aug 27, 2026