Loading story…
Red Hat released RHACS 4.4.7 to remediate CVE-2024-21538, a regular-expression denial-of-service flaw in the Node.js cross-spawn component. Crafted oversized input can trigger costly regular-expression backtracking, consuming CPU resources and potentially crashing an affected application. Red Hat rates the issue Low severity with a CVSS v3.1 score of 4.4, although CVE records score it 7.5 under a network-accessible, low-complexity vector.
Organizations running earlier Red Hat Advanced Cluster Security 4.4 releases should upgrade to 4.4.7, as specified in advisory RHSA-2024:10665. The update applies to RHACS Kubernetes deployments on RHEL 8 for x86_64, IBM Z and LinuxONE (s390x), and IBM Power little-endian (ppc64le); Red Hat also issued fixes across affected offerings including OpenShift Container Platform 4.14 through 4.17, Developer Hub, and Discovery 1 for RHEL 9.
See affected versions and whether adversaries are exploiting it.
11 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:1249 to remediate CVE-2024-21538 in the discovery-server-rhel9 and discovery-ui-rhel9 components of Discovery 1 for RHEL 9.
Red Hat released RHSA-2024:11031 to remediate CVE-2024-21538 in Red Hat OpenShift Container Platform 4.14.
Red Hat released RHBA-2024:10760 to remediate CVE-2024-21538 in Red Hat Developer Hub 1.3 on RHEL 9.
Red Hat released RHSA-2024:10839 for OpenShift Container Platform 4.15 and RHSA-2024:10823 for version 4.16, remediating CVE-2024-21538 in both releases.
Red Hat released RHSA-2024:10518 to remediate CVE-2024-21538 in Red Hat OpenShift Container Platform 4.17.
Red Hat issued low-severity advisory RHSA-2024:10665, providing RHACS 4.4.7 images that fix CVE-2024-21538. Users of earlier RHACS 4.4 versions were advised to upgrade.
Red Hat released RHSA-2024:10186 to remediate CVE-2024-21538 in Red Hat Advanced Cluster Security 4.5.
Red Hat published the CVE record for CVE-2024-21538, a regular-expression denial-of-service vulnerability in the Node.js cross-spawn package that can cause excessive CPU use or application crashes through crafted input.
The cross-spawn project published fixes associated with commits 5ff3a07d9add449021d806e45c4168203aa833ff and 640d391fde65388548601d95abedccc12943374f.
Red Hat released RHSA-2025:8510 to remediate CVE-2024-21538 in Red Hat Migration Toolkit for Containers 1.8.
The cross-spawn project added commit ba5aaef, titled "fix: disable regexp backtracking," on November 18, 2024, reintroducing mitigation for CVE-2024-21538 after the initial change had been reverted because of an escaping bug.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceredhat.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important security updates for **Red Hat Advanced Cluster Security for Kubernetes (RHACS)** 4.5, 4.6, and 4.7. Updated images—RHACS 4.5.9, 4.6.5, and 4.7.2—remediate vulnerabilities in bundled `http-proxy-middleware`, `redoc`, `golang-jwt/jwt`, and, for 4.5, `libxml2` and OpenSSL. The fixes include `CVE-2024-21536` and `CVE-2024-57083`, denial-of-service issues respectively involving `http-proxy-middleware` and Redoc prototype pollution, plus `CVE-2025-30204`, which can cause excessive memory allocation while parsing JWT headers. The releases also correct selected product defects affecting compliance displays, delegated scanning, RBAC, GKE compatibility, and image-signature verification. Red Hat also updated Submariner container images used by **Red Hat Advanced Cluster Management for Kubernetes (ACM)** 2.11 and 2.12, delivering Submariner 0.18.5 and 0.19.4. These images address an ICMP Packet Too Large injection issue in `quic-go` and memory-consumption flaws in `golang.org/x/oauth2/jws` and `golang-jwt/jwt`; the ACM 2.11 update additionally fixes sensitive HTTP-header leakage through cross-domain redirects in Go `net/http` and a P-256 timing side channel on `ppc64le`. Organizations should upgrade affected RHACS and ACM deployments to the supplied patched container images across their supported architectures.
Aug 27, 2026
Red Hat's Multicluster Engine for Kubernetes 2.5.2 release images remediate two moderate-severity third-party vulnerabilities: `CVE-2024-28176` in Jose and `CVE-2024-21501` in `sanitize-html`. RHBA-2024:1775 supplies refreshed images for aarch64, ppc64le, s390x, and x86_64 deployments and also affects related Red Hat Advanced Cluster Management and OpenShift Container Platform components. `CVE-2024-28176` can cause excessive CPU or memory consumption during JWE decryption, creating a denial-of-service condition (CVSS 5.3). `CVE-2024-21501` can allow an unauthenticated network attacker to enumerate server-side files and dependencies when `sanitize-html` permits the `style` attribute, exposing filesystem-layout information (CVSS 5.3); Red Hat Developer Hub remained listed as affected.
Aug 27, 2026
Red Hat issued security updates across **OpenShift Container Platform** 4.13–4.16, **Podman** for RHEL 9, **Red Hat Advanced Cluster Security** 4.4.5, Cluster Observability Operator 0.4.1, and OpenShift Data Foundation 4.14 to remediate **CVE-2024-6104**. The flaw in `go-retryablehttp` can cause sensitive information contained in URLs to be written to log files, creating a risk of credential or token exposure to users and systems with log access. Affected OpenShift releases span RHEL 8 and RHEL 9 deployments on x86_64, aarch64, ppc64le, and s390x architectures. Several advisories also fix related denial-of-service and input-validation flaws, including **CVE-2024-37298** in `gorilla/schema` (memory exhaustion), **CVE-2024-21538** in `cross-spawn` (regular-expression DoS), and defects in Go cryptography, protobuf JSON parsing, HAProxy, and other bundled components. Red Hat directs customers to update affected packages, container images, and clusters through supported release channels using the OpenShift web console or `oc` CLI, Red Hat package-update processes for Podman, and published image-update instructions for RHACS and Data Foundation.
Aug 27, 2026