Loading story…
Red Hat's Multicluster Engine for Kubernetes 2.5.2 release images remediate two moderate-severity third-party vulnerabilities: CVE-2024-28176 in Jose and CVE-2024-21501 in sanitize-html. RHBA-2024:1775 supplies refreshed images for aarch64, ppc64le, s390x, and x86_64 deployments and also affects related Red Hat Advanced Cluster Management and OpenShift Container Platform components.
CVE-2024-28176 can cause excessive CPU or memory consumption during JWE decryption, creating a denial-of-service condition (CVSS 5.3). CVE-2024-21501 can allow an unauthenticated network attacker to enumerate server-side files and dependencies when sanitize-html permits the style attribute, exposing filesystem-layout information (CVSS 5.3); Red Hat Developer Hub remained listed as affected.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHBA-2024:3555 to fix affected console components in Multicluster Engine for Kubernetes 2.4 for RHEL 8 for CVE-2024-21501 and CVE-2024-28176.
Red Hat released RHSA-2024:1770, fixing the affected ose-monitoring-plugin-rhel8 component in Red Hat OpenShift Container Platform 4.15 for CVE-2024-21501.
Red Hat issued RHBA-2024:1793 to fix affected console components in Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 for CVE-2024-21501 and CVE-2024-28176.
Red Hat published RHBA-2024:1775 for Multicluster Engine for Kubernetes 2.5.2 GA release images, addressing CVE-2024-21501 and CVE-2024-28176 with updated images for multiple architectures.
CVE-2024-28176, an uncontrolled resource-consumption flaw in Jose during JWE decryption, was publicly disclosed. The issue can cause excessive CPU or memory consumption and enable denial of service.
Red Hat issued RHBA-2025:1772 to fix CVE-2024-28176 in affected Red Hat Ceph Storage 7.1 components for RHEL 9, including ceph-nvmeof-cli, grafana, keepalived, and rhceph-7.
Red Hat issued RHBA-2024:3593, fixing the affected console-rhel8 component in Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 for CVE-2024-21501 and CVE-2024-28176.
A server-side use of sanitize-html with the style attribute permitted was identified as allowing unauthenticated attackers to enumerate files, including dependencies, and learn the target server's filesystem structure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important security updates for **Red Hat Advanced Cluster Security for Kubernetes (RHACS)** 4.5, 4.6, and 4.7. Updated images—RHACS 4.5.9, 4.6.5, and 4.7.2—remediate vulnerabilities in bundled `http-proxy-middleware`, `redoc`, `golang-jwt/jwt`, and, for 4.5, `libxml2` and OpenSSL. The fixes include `CVE-2024-21536` and `CVE-2024-57083`, denial-of-service issues respectively involving `http-proxy-middleware` and Redoc prototype pollution, plus `CVE-2025-30204`, which can cause excessive memory allocation while parsing JWT headers. The releases also correct selected product defects affecting compliance displays, delegated scanning, RBAC, GKE compatibility, and image-signature verification. Red Hat also updated Submariner container images used by **Red Hat Advanced Cluster Management for Kubernetes (ACM)** 2.11 and 2.12, delivering Submariner 0.18.5 and 0.19.4. These images address an ICMP Packet Too Large injection issue in `quic-go` and memory-consumption flaws in `golang.org/x/oauth2/jws` and `golang-jwt/jwt`; the ACM 2.11 update additionally fixes sensitive HTTP-header leakage through cross-domain redirects in Go `net/http` and a P-256 timing side channel on `ppc64le`. Organizations should upgrade affected RHACS and ACM deployments to the supplied patched container images across their supported architectures.
Aug 27, 2026
Red Hat released container-image and platform updates across its Kubernetes portfolio to remediate vulnerabilities in Go dependencies, chiefly **CVE-2024-45337** in `golang.org/x/crypto/ssh` and **CVE-2024-45338** in `golang.org/x/net/html`. The SSH issue can enable authorization bypass when applications misuse `ssh.ServerConfig.PublicKeyCallback`; the HTML flaw involves non-linear parsing of case-insensitive content. Affected products include OpenShift Container Platform 4.15 and 4.18, Advanced Cluster Management 2.9.6, Multicluster Global Hub 1.2 and 1.3, Gatekeeper 3.14 and 3.15, OpenShift Data Foundation 4.15, VolSync 0.10 and 0.11, and Advanced Cluster Security (RHACS) 4.4 and 4.5. Several releases also address **CVE-2024-53259**, a `quic-go` denial-of-service flaw in which forged ICMP Packet Too Large messages can disrupt established QUIC connections, and RHACS 4.6.2 fixes `go-git` argument injection (**CVE-2025-21613**) and malicious Git-server reply denial of service (**CVE-2025-21614**). Red Hat recommends upgrading affected platforms and container images through their supported release channels, including deployments on x86_64, aarch64, ppc64le, and s390x where applicable; RHACS customers should move to 4.4.8, 4.5.6, or 4.6.2 according to their release stream.
Aug 27, 2026
Red Hat released Important-rated OpenShift Container Platform updates for versions 4.15, 4.16, 4.17, and 4.18, including 4.15.50, 4.16.33, 4.17.25, 4.18.8, and 4.18.9. The releases remediate **CVE-2025-30204**, a high-severity denial-of-service flaw in `golang-jwt/jwt` where JWT header parsing can cause excessive memory allocation from attacker-controlled tokens containing numerous period characters. Fixed upstream versions are 4.5.2 and 5.2.2. The updates also address **CVE-2024-11218**, a Podman/Buildah race condition that can enable container breakout, plus flaws in GRUB2, libxml2, Jinja2, BIND, and go-jose. Several releases fix **CVE-2025-29781**, in which the Bare Metal Operator's `BMCEventSubscription` custom resource could expose secrets across namespaces. Red Hat advises affected organizations to upgrade clusters through their applicable OpenShift release channels using the OpenShift CLI or web console across supported RHEL 8 and RHEL 9 platforms.
Aug 27, 2026