RHSA-2026:34608

Vulnerability from csaf_redhat - Published: 2026-07-02 00:03 - Updated: 2026-07-03 12:14
Summary
Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update
Severity
Important
Notes
Topic: Streams for Apache Kafka 2.9.4 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat Streams for Apache Kafka 2.9.4 serves as a replacement for Red Hat Streams for Apache Kafka 2.9.3, and includes security and bug fixes, and enhancements. Security Fix(es): * jose4j: Denial of Service via compressed JWE content (CVE-2024-29371) * cluster-operator: Cross-namespace privilege escalation via Kafka.spec.entityOperator.watchedNamespace in Strimzi (CVE-2026-55225) * netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVE-2025-58056) * lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800) * React Server Components: Denial of Service via specially crafted HTTP requests (CVE-2026-23864) * Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing (CVE-2026-24281) * netty-codec-http: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values (CVE-2026-33870) * netty-codec-http2: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871) * log4j-core: Invalid XML output causes denial of service in logging (CVE-2026-34480) * quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests (CVE-2026-39852) * netty-codec: Denial of Service via excessive memory allocation in LZ4FrameDecoder (CVE-2026-42583) * netty-codec-http2: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) * netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) * Next.js: Information disclosure due to middleware bypass in Pages Router with i18n (CVE-2026-44573) * Next.js: Authorization bypass via crafted query parameters (CVE-2026-44574) * Next.js: Unauthorized access to protected content via middleware bypass (CVE-2026-44575) * Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests (CVE-2026-44578) * Next.js: Denial of Service via crafted POST requests to server actions (CVE-2026-44579) * netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893) * Next.js: Information disclosure via security fix bypass in middleware with Turbopack (CVE-2026-45109) * netty-handler: Denial of Service via eager buffer allocation in TLS handshake (CVE-2026-45416) * netty-resolver-dns: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) * netty-resolver-dns: Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043) * netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059) * netty-handler: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) * quarkus-vertx-http: Authorization bypass in HTTP path-based policies via encoded characters (CVE-2026-50559) * lodash: Prototype pollution in _.unset and _.omit functions (CVE-2025-13465) * vertx-core: Static handler component cache can be manipulated to deny access to static files (CVE-2026-1002) * vertx-core: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860) * Apache ZooKeeper: Information disclosure via improper handling of configuration values (CVE-2026-24308) * Next.js: Unbounded next/image disk cache growth can exhaust storage (CVE-2026-27980) * DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization (CVE-2026-41240) * axios: Invisible JSON Response Tampering via Prototype Pollution Gadget (CVE-2026-42044) * Next.js: Denial of Service via Image Optimization API (CVE-2026-44577)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2024-29371

A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Threats
Impact Important
CVE-2025-13465

A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2025-58056

A flaw in Netty’s HTTP/1.1 chunked encoding parser allows newline (LF) characters in chunk extensions to be incorrectly treated as the end of the chunk-size line instead of requiring the proper CRLF sequence. This discrepancy can be exploited in rare cases where a reverse proxy interprets the same input differently, potentially enabling HTTP request smuggling attacks such as bypassing access controls or corrupting responses.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-1002

A flaw was found in Vert.x. The Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URIs, preventing legitimate users from accessing static files with an HTTP 404 response.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-4800

A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-6860

A flaw was found in eclipse-vertx/vert.x. A remote attacker can exploit this vulnerability by performing a Transport Layer Security (TLS) handshake and presenting a server name extension with a server wildcard name. This can lead to a denial of service (DoS) condition, impacting the availability of the affected system.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-23864

A flaw was found in React Server Components. A remote attacker can exploit this vulnerability by sending specially crafted HTTP requests to Server Function endpoints. This can lead to a Denial of Service (DoS), causing server crashes, out-of-memory exceptions, or excessive CPU usage, thereby impacting the availability of applications.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1284 - Improper Validation of Specified Quantity in Input
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Threats
Impact Important
CVE-2026-24281

A flaw was found in Apache ZooKeeper. The ZKTrustManager component's hostname verification process can fall back to reverse DNS (PTR) lookup when IP Subject Alternative Name (SAN) validation fails. This vulnerability allows an attacker who can control or spoof PTR records to impersonate ZooKeeper servers or clients, provided they possess a valid certificate for the PTR name. This could lead to unauthorized access or manipulation of ZooKeeper services.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-24308

A flaw was found in Apache ZooKeeper. Improper handling of configuration values in ZKConfig allows an attacker to expose sensitive information. This occurs when sensitive client configuration values are logged at an INFO level in the client's logfile. This vulnerability can lead to information disclosure, potentially revealing critical system details to unauthorized parties.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-117 - Improper Output Neutralization for Logs
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-27980

An unbounded disk usage flaw has been discovered in Next.js. The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-33870

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-33871

A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server's lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Threats
Impact Important
CVE-2026-34480

A flaw was found in Apache Log4j Core. The XmlLayout component, responsible for formatting log messages into XML, does not properly remove or replace characters that are not allowed in XML 1.0. When log messages or diagnostic information contain these forbidden characters, the resulting XML output becomes invalid. This can lead to two main issues: either systems processing these logs will fail to read the affected records, or the logging process itself will stop delivering events, both resulting in a denial of service for logging operations.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-168 - Improper Handling of Inconsistent Special Elements
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-39852

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected endpoints. The vulnerability arises because Quarkus's security layer performs authorization checks on the raw URL path, which preserves these matrix parameters.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-41240

A flaw was found in DOMPurify, a DOM-only cross-site scripting sanitizer. A remote attacker could exploit an inconsistency in how forbidden tags and attributes are handled when function-based tag additions are used. This allows malicious HTML, MathML, or SVG elements to bypass sanitization and execute arbitrary code in the user's browser, leading to Cross-Site Scripting (XSS).

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-42044

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution "Gadget" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-42583

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory (up to 32 MB per block) before the LZ4 decompression runs, leading to excessive memory consumption and a denial of service (DoS) for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-42587

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44249

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44573

A flaw was found in Next.js. Applications utilizing the Pages Router with internationalization (i18n) configured and middleware or proxy-based authorization are susceptible to unauthorized access. A remote attacker can exploit this by making locale-less /_next/data/<buildId>/<page>.json requests, which bypass the intended authorization checks. This allows the attacker to retrieve sensitive server-side rendered (SSR) JSON data from protected pages, leading to information disclosure.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44574

A flaw was found in Next.js. This vulnerability allows an attacker to bypass security checks in web applications that use Next.js middleware to protect specific web pages. By sending specially crafted web addresses, an attacker can access protected content without proper authorization. This could lead to unauthorized viewing of sensitive information or access to restricted features.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44575

A flaw was found in Next.js. App Router applications that use middleware or proxy-based authorization checks are vulnerable to unauthorized access. A remote attacker can exploit this by crafting specific .rsc and segment-prefetch URLs, which bypass the intended middleware rules. This allows access to protected content without proper authorization.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44577

A flaw was found in Next.js. When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. A remote attacker could exploit this by requesting large local assets from the /_next/image endpoint. This can lead to out-of-memory conditions, resulting in a Denial of Service (DoS) for the application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44578

A flaw was found in Next.js. Self-hosted applications utilizing the built-in Node.js server are vulnerable to Server-Side Request Forgery (SSRF) through specially crafted WebSocket upgrade requests. A remote attacker can exploit this by causing the server to proxy requests to arbitrary internal or external destinations. This could lead to the exposure of internal services or sensitive cloud metadata endpoints.

8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE-918 - Server-Side Request Forgery (SSRF)
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44579

A flaw was found in Next.js. Applications utilizing Partial Prerendering via the Cache Components feature are susceptible to connection exhaustion. A remote attacker can send crafted POST requests to a server action, triggering a request-body handling deadlock. This leaves connections open, consuming server resources and ultimately leading to a Denial of Service (DoS) for legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-833 - Deadlock
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44893

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-805 - Buffer Access with Incorrect Length Value
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-45109

A flaw was found in Next.js. A remote unauthenticated attacker could exploit a bypass in a security fix when using middleware.ts with Turbopack. This vulnerability could lead to the disclosure of sensitive information.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-358 - Improperly Implemented Security Check for Standard
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-45416

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-45674

A flaw was found in Netty's DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses, which could enable an attacker to redirect network traffic or intercept sensitive data from affected applications.

8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-47691

A flaw was found in Netty's `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.

8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-48043

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-48059

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-50010

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-50559

A flaw was found in Quarkus. A remote attacker could bypass HTTP path-based authorization policies by using specially crafted encoded semicolons, slashes, or backslashes in HTTP requests. This could allow unauthorized access to protected static resources, leading to information disclosure.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Product Identifier Version Remediation
Streams for Apache Kafka 2.9.4
Red Hat / Red Hat OpenShift Enterprise
 cpe:/a:redhat:amq_streams:2.9::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:34608 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2392996 external
https://bugzilla.redhat.com/show_bug.cgi?id=2423194 external
https://bugzilla.redhat.com/show_bug.cgi?id=2430180 external
https://bugzilla.redhat.com/show_bug.cgi?id=2431740 external
https://bugzilla.redhat.com/show_bug.cgi?id=2433059 external
https://bugzilla.redhat.com/show_bug.cgi?id=2445449 external
https://bugzilla.redhat.com/show_bug.cgi?id=2445451 external
https://bugzilla.redhat.com/show_bug.cgi?id=2448509 external
https://bugzilla.redhat.com/show_bug.cgi?id=2452453 external
https://bugzilla.redhat.com/show_bug.cgi?id=2452456 external
https://bugzilla.redhat.com/show_bug.cgi?id=2453496 external
https://bugzilla.redhat.com/show_bug.cgi?id=2457328 external
https://bugzilla.redhat.com/show_bug.cgi?id=2457819 external
https://bugzilla.redhat.com/show_bug.cgi?id=2461147 external
https://bugzilla.redhat.com/show_bug.cgi?id=2461624 external
https://bugzilla.redhat.com/show_bug.cgi?id=2466990 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477187 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477188 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477190 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477193 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477194 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477199 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477207 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477219 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477220 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488081 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488439 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2024-29371 self
https://bugzilla.redhat.com/show_bug.cgi?id=2423194 external
https://www.cve.org/CVERecord?id=CVE-2024-29371 external
https://nvd.nist.gov/vuln/detail/CVE-2024-29371 external
https://bitbucket.org/b_c/jose4j/issues/220/vuln-… external
https://access.redhat.com/security/cve/CVE-2025-13465 self
https://bugzilla.redhat.com/show_bug.cgi?id=2431740 external
https://www.cve.org/CVERecord?id=CVE-2025-13465 external
https://nvd.nist.gov/vuln/detail/CVE-2025-13465 external
https://github.com/lodash/lodash/security/advisor… external
https://access.redhat.com/security/cve/CVE-2025-58056 self
https://bugzilla.redhat.com/show_bug.cgi?id=2392996 external
https://www.cve.org/CVERecord?id=CVE-2025-58056 external
https://nvd.nist.gov/vuln/detail/CVE-2025-58056 external
https://datatracker.ietf.org/doc/html/rfc9112#nam… external
https://github.com/JLLeitschuh/unCVEed/issues/1 external
https://github.com/netty/netty/commit/edb55fd8e0a… external
https://github.com/netty/netty/issues/15522 external
https://github.com/netty/netty/pull/15611 external
https://github.com/netty/netty/security/advisorie… external
https://w4ke.info/2025/06/18/funky-chunks.html external
https://access.redhat.com/security/cve/CVE-2026-1002 self
https://bugzilla.redhat.com/show_bug.cgi?id=2430180 external
https://www.cve.org/CVERecord?id=CVE-2026-1002 external
https://nvd.nist.gov/vuln/detail/CVE-2026-1002 external
https://github.com/eclipse-vertx/vert.x/pull/5895 external
https://access.redhat.com/security/cve/CVE-2026-4800 self
https://bugzilla.redhat.com/show_bug.cgi?id=2453496 external
https://www.cve.org/CVERecord?id=CVE-2026-4800 external
https://nvd.nist.gov/vuln/detail/CVE-2026-4800 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/advisories/GHSA-35jh-r3h4-6jhm external
https://github.com/lodash/lodash/commit/3469357cf… external
https://access.redhat.com/security/cve/CVE-2026-6860 self
https://bugzilla.redhat.com/show_bug.cgi?id=2466990 external
https://www.cve.org/CVERecord?id=CVE-2026-6860 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6860 external
https://github.com/eclipse-vertx/vert.x/pull/6102 external
https://github.com/eclipse-vertx/vert.x/security/… external
https://gitlab.eclipse.org/security/vulnerability… external
https://access.redhat.com/security/cve/CVE-2026-23864 self
https://bugzilla.redhat.com/show_bug.cgi?id=2433059 external
https://www.cve.org/CVERecord?id=CVE-2026-23864 external
https://nvd.nist.gov/vuln/detail/CVE-2026-23864 external
https://github.com/facebook/react/security/adviso… external
https://www.facebook.com/security/advisories/cve-… external
https://access.redhat.com/security/cve/CVE-2026-24281 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445449 external
https://www.cve.org/CVERecord?id=CVE-2026-24281 external
https://nvd.nist.gov/vuln/detail/CVE-2026-24281 external
https://lists.apache.org/thread/088ddsbrzhd5lxzbq… external
https://access.redhat.com/security/cve/CVE-2026-24308 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445451 external
https://www.cve.org/CVERecord?id=CVE-2026-24308 external
https://nvd.nist.gov/vuln/detail/CVE-2026-24308 external
https://lists.apache.org/thread/qng3rtzv2pqkmko4r… external
https://access.redhat.com/security/cve/CVE-2026-27980 self
https://bugzilla.redhat.com/show_bug.cgi?id=2448509 external
https://www.cve.org/CVERecord?id=CVE-2026-27980 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27980 external
https://github.com/vercel/next.js/commit/39eb8e0a… external
https://github.com/vercel/next.js/releases/tag/v16.1.7 external
https://github.com/vercel/next.js/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-33870 self
https://bugzilla.redhat.com/show_bug.cgi?id=2452453 external
https://www.cve.org/CVERecord?id=CVE-2026-33870 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33870 external
https://github.com/netty/netty/security/advisorie… external
https://w4ke.info/2025/10/29/funky-chunks-2.html external
https://www.rfc-editor.org/rfc/rfc9110 external
https://access.redhat.com/security/cve/CVE-2026-33871 self
https://bugzilla.redhat.com/show_bug.cgi?id=2452456 external
https://www.cve.org/CVERecord?id=CVE-2026-33871 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33871 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-34480 self
https://bugzilla.redhat.com/show_bug.cgi?id=2457328 external
https://www.cve.org/CVERecord?id=CVE-2026-34480 external
https://nvd.nist.gov/vuln/detail/CVE-2026-34480 external
https://github.com/apache/logging-log4j2/pull/4077 external
https://lists.apache.org/thread/5x0hcnng0chhghp6j… external
https://logging.apache.org/cyclonedx/vdr.xml external
https://logging.apache.org/log4j/2.x/manual/layou… external
https://logging.apache.org/security.html#CVE-2026-34480 external
https://access.redhat.com/security/cve/CVE-2026-39852 self
https://bugzilla.redhat.com/show_bug.cgi?id=2457819 external
https://www.cve.org/CVERecord?id=CVE-2026-39852 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39852 external
https://github.com/quarkusio/quarkus/security/adv… external
https://access.redhat.com/security/cve/CVE-2026-41240 self
https://bugzilla.redhat.com/show_bug.cgi?id=2461147 external
https://www.cve.org/CVERecord?id=CVE-2026-41240 external
https://nvd.nist.gov/vuln/detail/CVE-2026-41240 external
https://github.com/cure53/DOMPurify/commit/c361ba… external
https://github.com/cure53/DOMPurify/releases/tag/3.4.0 external
https://github.com/cure53/DOMPurify/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-42044 self
https://bugzilla.redhat.com/show_bug.cgi?id=2461624 external
https://www.cve.org/CVERecord?id=CVE-2026-42044 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42044 external
https://github.com/axios/axios/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42583 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477219 external
https://www.cve.org/CVERecord?id=CVE-2026-42583 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42583 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-42587 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477220 external
https://www.cve.org/CVERecord?id=CVE-2026-42587 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42587 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-44249 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488081 external
https://www.cve.org/CVERecord?id=CVE-2026-44249 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44249 external
https://github.com/netty/netty/releases/tag/netty… external
https://github.com/netty/netty/releases/tag/netty… external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-44573 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477199 external
https://www.cve.org/CVERecord?id=CVE-2026-44573 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44573 external
https://github.com/vercel/next.js/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-44574 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477207 external
https://www.cve.org/CVERecord?id=CVE-2026-44574 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44574 external
https://github.com/vercel/next.js/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-44575 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477188 external
https://www.cve.org/CVERecord?id=CVE-2026-44575 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44575 external
https://github.com/vercel/next.js/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-44577 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477194 external
https://www.cve.org/CVERecord?id=CVE-2026-44577 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44577 external
https://github.com/vercel/next.js/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-44578 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477187 external
https://www.cve.org/CVERecord?id=CVE-2026-44578 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44578 external
https://github.com/vercel/next.js/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-44579 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477193 external
https://www.cve.org/CVERecord?id=CVE-2026-44579 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44579 external
https://github.com/vercel/next.js/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-44893 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488383 external
https://www.cve.org/CVERecord?id=CVE-2026-44893 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44893 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-45109 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477190 external
https://www.cve.org/CVERecord?id=CVE-2026-45109 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45109 external
https://github.com/vercel/next.js/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-45416 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488391 external
https://www.cve.org/CVERecord?id=CVE-2026-45416 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45416 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-45674 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488400 external
https://www.cve.org/CVERecord?id=CVE-2026-45674 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45674 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-47691 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488439 external
https://www.cve.org/CVERecord?id=CVE-2026-47691 external
https://nvd.nist.gov/vuln/detail/CVE-2026-47691 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-48043 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488442 external
https://www.cve.org/CVERecord?id=CVE-2026-48043 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48043 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-48059 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488437 external
https://www.cve.org/CVERecord?id=CVE-2026-48059 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48059 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-50010 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488429 external
https://www.cve.org/CVERecord?id=CVE-2026-50010 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50010 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-50559 self
https://bugzilla.redhat.com/show_bug.cgi?id=2486959 external
https://www.cve.org/CVERecord?id=CVE-2026-50559 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50559 external
https://github.com/quarkusio/quarkus/security/adv… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Streams for Apache Kafka 2.9.4 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed\nbackbone that allows microservices and other applications to share data with\nextremely high throughput and extremely low latency.\n\nThis release of Red Hat Streams for Apache Kafka 2.9.4 serves as a replacement for Red Hat Streams for Apache Kafka 2.9.3, and includes security and bug fixes, and enhancements.\n\nSecurity Fix(es):\n\n  * jose4j: Denial of Service via compressed JWE content (CVE-2024-29371)\n  * cluster-operator: Cross-namespace privilege escalation via Kafka.spec.entityOperator.watchedNamespace in Strimzi (CVE-2026-55225)\n  * netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVE-2025-58056)\n  * lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)\n  * React Server Components: Denial of Service via specially crafted HTTP requests (CVE-2026-23864)\n  * Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing (CVE-2026-24281)\n  * netty-codec-http: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values (CVE-2026-33870)\n  * netty-codec-http2: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871)\n  * log4j-core: Invalid XML output causes denial of service in logging (CVE-2026-34480)\n  * quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests (CVE-2026-39852)\n  * netty-codec: Denial of Service via excessive memory allocation in LZ4FrameDecoder (CVE-2026-42583)\n  * netty-codec-http2: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)\n  * netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)\n  * Next.js: Information disclosure due to middleware bypass in Pages Router with i18n (CVE-2026-44573)\n  * Next.js: Authorization bypass via crafted query parameters (CVE-2026-44574)\n  * Next.js: Unauthorized access to protected content via middleware bypass (CVE-2026-44575)\n  * Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests (CVE-2026-44578)\n  * Next.js: Denial of Service via crafted POST requests to server actions (CVE-2026-44579)\n  * netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893)\n  * Next.js: Information disclosure via security fix bypass in middleware with Turbopack (CVE-2026-45109)\n  * netty-handler: Denial of Service via eager buffer allocation in TLS handshake (CVE-2026-45416)\n  * netty-resolver-dns: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)\n  * netty-resolver-dns: Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)\n  * netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043)\n  * netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)\n  * netty-handler: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)\n  * quarkus-vertx-http: Authorization bypass in HTTP path-based policies via encoded characters (CVE-2026-50559)\n  * lodash: Prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n  * vertx-core: Static handler component cache can be manipulated to deny access to static files (CVE-2026-1002)\n  * vertx-core: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860)\n  * Apache ZooKeeper: Information disclosure via improper handling of configuration values (CVE-2026-24308)\n  * Next.js: Unbounded next/image disk cache growth can exhaust storage (CVE-2026-27980)\n  * DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization (CVE-2026-41240)\n  * axios: Invisible JSON Response Tampering via Prototype Pollution Gadget (CVE-2026-42044)\n  * Next.js: Denial of Service via Image Optimization API (CVE-2026-44577)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:34608",
        "url": "https://access.redhat.com/errata/RHSA-2026:34608"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2392996",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392996"
      },
      {
        "category": "external",
        "summary": "2423194",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
      },
      {
        "category": "external",
        "summary": "2430180",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430180"
      },
      {
        "category": "external",
        "summary": "2431740",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
      },
      {
        "category": "external",
        "summary": "2433059",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433059"
      },
      {
        "category": "external",
        "summary": "2445449",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445449"
      },
      {
        "category": "external",
        "summary": "2445451",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445451"
      },
      {
        "category": "external",
        "summary": "2448509",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448509"
      },
      {
        "category": "external",
        "summary": "2452453",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
      },
      {
        "category": "external",
        "summary": "2452456",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452456"
      },
      {
        "category": "external",
        "summary": "2453496",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
      },
      {
        "category": "external",
        "summary": "2457328",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457328"
      },
      {
        "category": "external",
        "summary": "2457819",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457819"
      },
      {
        "category": "external",
        "summary": "2461147",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461147"
      },
      {
        "category": "external",
        "summary": "2461624",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461624"
      },
      {
        "category": "external",
        "summary": "2466990",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466990"
      },
      {
        "category": "external",
        "summary": "2477187",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477187"
      },
      {
        "category": "external",
        "summary": "2477188",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477188"
      },
      {
        "category": "external",
        "summary": "2477190",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477190"
      },
      {
        "category": "external",
        "summary": "2477193",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477193"
      },
      {
        "category": "external",
        "summary": "2477194",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477194"
      },
      {
        "category": "external",
        "summary": "2477199",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477199"
      },
      {
        "category": "external",
        "summary": "2477207",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477207"
      },
      {
        "category": "external",
        "summary": "2477219",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477219"
      },
      {
        "category": "external",
        "summary": "2477220",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
      },
      {
        "category": "external",
        "summary": "2488081",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
      },
      {
        "category": "external",
        "summary": "2488439",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488439"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34608.json"
      }
    ],
    "title": "Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update",
    "tracking": {
      "current_release_date": "2026-07-03T12:14:41+00:00",
      "generator": {
        "date": "2026-07-03T12:14:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.1"
        }
      },
      "id": "RHSA-2026:34608",
      "initial_release_date": "2026-07-02T00:03:15+00:00",
      "revision_history": [
        {
          "date": "2026-07-02T00:03:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-02T00:03:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-03T12:14:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Streams for Apache Kafka 2.9.4",
                "product": {
                  "name": "Streams for Apache Kafka 2.9.4",
                  "product_id": "Streams for Apache Kafka 2.9.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:amq_streams:2.9::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-29371",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2025-12-17T16:01:18.173727+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2423194"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-29371"
        },
        {
          "category": "external",
          "summary": "RHBZ#2423194",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
        },
        {
          "category": "external",
          "summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
          "url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
        }
      ],
      "release_date": "2025-12-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
    },
    {
      "cve": "CVE-2025-13465",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "discovery_date": "2026-01-21T20:01:28.774829+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431740"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "lodash: prototype pollution in _.unset and _.omit functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is only exploitable by applications using the _.unset and _.omit functions on an object and allowing user input to determine the path of the property to be removed. This issue only allows the deletion of properties but does not allow overwriting their behavior, limiting the impact to a denial of service. Due to this reason, this vulnerability has been rated with an important severity.\n\nIn Grafana, JavaScript code runs only in the browser, while the server side is all Golang. Therefore, the worst-case scenario is a loss of functionality in the client application inside the browser. To reflect this, the CVSS availability metric and the severity of the Grafana and the Grafana-PCP component have been updated to low and moderate, respectively.\n\nThe lodash dependency is bundled and used by the pcs-web-ui component of the PCS package. In Red Hat Enterprise Linux 8.10, the pcs-web-ui component is no longer included in the PCS package. As a result, RHEL 8.10 does not ship the vulnerable lodash component within PCS and is therefore not-affected by this CVE.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-13465"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431740",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-13465",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465"
        },
        {
          "category": "external",
          "summary": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
          "url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
        }
      ],
      "release_date": "2026-01-21T19:05:28.846000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "lodash: prototype pollution in _.unset and _.omit functions"
    },
    {
      "cve": "CVE-2025-58056",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2025-09-03T21:01:22.935850+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2392996"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in Netty\u2019s HTTP/1.1 chunked encoding parser allows newline (LF) characters in chunk extensions to be incorrectly treated as the end of the chunk-size line instead of requiring the proper CRLF sequence. This discrepancy can be exploited in rare cases where a reverse proxy interprets the same input differently, potentially enabling HTTP request smuggling attacks such as bypassing access controls or corrupting responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is considered Moderate rather than Important because successful exploitation depends on a very specific deployment condition: the presence of an intermediary reverse proxy that both mishandles lone LF characters in chunk extensions and forwards them unmodified to Netty. By itself, Netty\u2019s parsing quirk does not introduce risk, and in most real-world environments, reverse proxies normalize or reject malformed chunked requests, preventing smuggling. As a result, the vulnerability has limited reach, requires a niche configuration to be exploitable, and does not universally expose Netty-based servers to request smuggling\u2014hence it is rated moderate in severity rather than important or critical.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-58056"
        },
        {
          "category": "external",
          "summary": "RHBZ#2392996",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392996"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-58056",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-58056"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58056",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58056"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc9112#name-chunked-transfer-coding",
          "url": "https://datatracker.ietf.org/doc/html/rfc9112#name-chunked-transfer-coding"
        },
        {
          "category": "external",
          "summary": "https://github.com/JLLeitschuh/unCVEed/issues/1",
          "url": "https://github.com/JLLeitschuh/unCVEed/issues/1"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/edb55fd8e0a3bcbd85881e423464f585183d1284",
          "url": "https://github.com/netty/netty/commit/edb55fd8e0a3bcbd85881e423464f585183d1284"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/issues/15522",
          "url": "https://github.com/netty/netty/issues/15522"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/pull/15611",
          "url": "https://github.com/netty/netty/pull/15611"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49"
        },
        {
          "category": "external",
          "summary": "https://w4ke.info/2025/06/18/funky-chunks.html",
          "url": "https://w4ke.info/2025/06/18/funky-chunks.html"
        }
      ],
      "release_date": "2025-09-03T20:56:50.732000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, enforce strict RFC compliance on all front-end proxies and load balancers so that lone LF characters in chunk extensions are rejected or normalized before being forwarded. Additionally, configure input validation at the application or proxy layer to block malformed chunked requests, ensuring consistent parsing across all components in the request path.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions"
    },
    {
      "cve": "CVE-2026-1002",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-01-15T21:03:20.088599+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2430180"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vert.x. The Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URIs, preventing legitimate users from accessing static files with an HTTP 404 response.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability allows a remote attacker to block access to specific static files, such as images, CSS or HTML files. However, the underlying Vert.x server, the API endpoints and other non-cached resources are not affected. Due to this reason, this issue has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1002"
        },
        {
          "category": "external",
          "summary": "RHBZ#2430180",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430180"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1002",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1002"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1002",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1002"
        },
        {
          "category": "external",
          "summary": "https://github.com/eclipse-vertx/vert.x/pull/5895",
          "url": "https://github.com/eclipse-vertx/vert.x/pull/5895"
        }
      ],
      "release_date": "2026-01-15T20:50:25.642000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, consider disabling the static handler cache by configuring the StaticHandler instance with setCachingEnabled(false), for example:\n\n~~~\nStaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);\n~~~",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files"
    },
    {
      "cve": "CVE-2026-4800",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-03-31T20:01:21.918257+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453496"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4800"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453496",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
          "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
        },
        {
          "category": "external",
          "summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
          "url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
        }
      ],
      "release_date": "2026-03-31T19:25:55.987000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
    },
    {
      "cve": "CVE-2026-6860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-06T10:01:43.929832+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466990"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in eclipse-vertx/vert.x. A remote attacker can exploit this vulnerability by performing a Transport Layer Security (TLS) handshake and presenting a server name extension with a server wildcard name. This can lead to a denial of service (DoS) condition, impacting the availability of the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Moderate because a remote attacker can trigger a denial of service in Red Hat products that use `eclipse-vertx/vert.x` and are configured with TLS wildcard server names. Exploitation occurs during the TLS handshake, impacting service availability without affecting data confidentiality or integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466990",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466990"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6860"
        },
        {
          "category": "external",
          "summary": "https://github.com/eclipse-vertx/vert.x/pull/6102",
          "url": "https://github.com/eclipse-vertx/vert.x/pull/6102"
        },
        {
          "category": "external",
          "summary": "https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-3g76-f9xq-8vp6",
          "url": "https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-3g76-f9xq-8vp6"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/381",
          "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/381"
        }
      ],
      "release_date": "2026-05-06T09:55:12.531000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name"
    },
    {
      "cve": "CVE-2026-23864",
      "cwe": {
        "id": "CWE-1284",
        "name": "Improper Validation of Specified Quantity in Input"
      },
      "discovery_date": "2026-01-26T20:01:54.396535+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2433059"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in React Server Components. A remote attacker can exploit this vulnerability by sending specially crafted HTTP requests to Server Function endpoints. This can lead to a Denial of Service (DoS), causing server crashes, out-of-memory exceptions, or excessive CPU usage, thereby impacting the availability of applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "react-server-dom-webpack: react-server-dom-parcel: reactreact-server-dom-turbopack: React Server Components: Denial of Service via specially crafted HTTP requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-23864"
        },
        {
          "category": "external",
          "summary": "RHBZ#2433059",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433059"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-23864",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-23864"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23864",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23864"
        },
        {
          "category": "external",
          "summary": "https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg",
          "url": "https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg"
        },
        {
          "category": "external",
          "summary": "https://www.facebook.com/security/advisories/cve-2026-23864",
          "url": "https://www.facebook.com/security/advisories/cve-2026-23864"
        }
      ],
      "release_date": "2026-01-26T19:16:38.250000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "react-server-dom-webpack: react-server-dom-parcel: reactreact-server-dom-turbopack: React Server Components: Denial of Service via specially crafted HTTP requests"
    },
    {
      "cve": "CVE-2026-24281",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-03-07T09:00:57.868082+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445449"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache ZooKeeper. The ZKTrustManager component\u0027s hostname verification process can fall back to reverse DNS (PTR) lookup when IP Subject Alternative Name (SAN) validation fails. This vulnerability allows an attacker who can control or spoof PTR records to impersonate ZooKeeper servers or clients, provided they possess a valid certificate for the PTR name. This could lead to unauthorized access or manipulation of ZooKeeper services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache ZooKeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24281"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445449",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445449"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24281",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24281"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24281",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24281"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2",
          "url": "https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2"
        }
      ],
      "release_date": "2026-03-07T08:50:32.525000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable reverse DNS lookup in Apache ZooKeeper\u0027s client and quorum protocols. This can be achieved by configuring the `zookeeper.ssl.hostnameVerification.disableReverseDns` property to `true`. This configuration option is available in Apache ZooKeeper versions 3.8.6 and 3.9.5 and later. A restart of the ZooKeeper service will be required for the change to take effect.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache ZooKeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing"
    },
    {
      "cve": "CVE-2026-24308",
      "cwe": {
        "id": "CWE-117",
        "name": "Improper Output Neutralization for Logs"
      },
      "discovery_date": "2026-03-07T09:01:03.859129+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445451"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache ZooKeeper. Improper handling of configuration values in ZKConfig allows an attacker to expose sensitive information. This occurs when sensitive client configuration values are logged at an INFO level in the client\u0027s logfile. This vulnerability can lead to information disclosure, potentially revealing critical system details to unauthorized parties.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24308"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445451",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445451"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24308",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24308"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24308",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24308"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr",
          "url": "https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr"
        }
      ],
      "release_date": "2026-03-07T08:51:17.567000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values"
    },
    {
      "cve": "CVE-2026-27980",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-18T01:01:36.393672+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448509"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An unbounded disk usage flaw has been discovered in Next.js. The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27980"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448509",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448509"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27980",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27980"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27980",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27980"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/commit/39eb8e0ac498b48855a0430fbf4c22276a73b4bd",
          "url": "https://github.com/vercel/next.js/commit/39eb8e0ac498b48855a0430fbf4c22276a73b4bd"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/releases/tag/v16.1.7",
          "url": "https://github.com/vercel/next.js/releases/tag/v16.1.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8",
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8"
        }
      ],
      "release_date": "2026-03-18T00:23:34.862000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage"
    },
    {
      "cve": "CVE-2026-33870",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-03-27T21:01:59.865839+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2452453"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33870"
        },
        {
          "category": "external",
          "summary": "RHBZ#2452453",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33870",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8"
        },
        {
          "category": "external",
          "summary": "https://w4ke.info/2025/06/18/funky-chunks.html",
          "url": "https://w4ke.info/2025/06/18/funky-chunks.html"
        },
        {
          "category": "external",
          "summary": "https://w4ke.info/2025/10/29/funky-chunks-2.html",
          "url": "https://w4ke.info/2025/10/29/funky-chunks-2.html"
        },
        {
          "category": "external",
          "summary": "https://www.rfc-editor.org/rfc/rfc9110",
          "url": "https://www.rfc-editor.org/rfc/rfc9110"
        }
      ],
      "release_date": "2026-03-27T19:54:15.586000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values"
    },
    {
      "cve": "CVE-2026-33871",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-03-27T21:02:13.396015+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2452456"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server\u0027s lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This important vulnerability in Netty HTTP/2 servers allows a remote attacker to cause a Denial of Service by sending a flood of CONTINUATION frames. This can lead to excessive CPU consumption and render the server unresponsive. Red Hat products utilizing affected Netty versions, such as Red Hat AMQ, Enterprise Application Platform, and OpenShift Container Platform components, are impacted if configured to use HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33871"
        },
        {
          "category": "external",
          "summary": "RHBZ#2452456",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452456"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33871",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv"
        }
      ],
      "release_date": "2026-03-27T19:55:23.135000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood"
    },
    {
      "cve": "CVE-2026-34480",
      "cwe": {
        "id": "CWE-168",
        "name": "Improper Handling of Inconsistent Special Elements"
      },
      "discovery_date": "2026-04-10T16:02:17.024798+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457328"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Log4j Core. The XmlLayout component, responsible for formatting log messages into XML, does not properly remove or replace characters that are not allowed in XML 1.0. When log messages or diagnostic information contain these forbidden characters, the resulting XML output becomes invalid. This can lead to two main issues: either systems processing these logs will fail to read the affected records, or the logging process itself will stop delivering events, both resulting in a denial of service for logging operations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in Apache Log4j Core\u0027s XmlLayout component can lead to a denial of service in logging operations when log messages contain characters forbidden by the XML 1.0 specification. Systems processing these logs may fail to read records or the logging process may cease event delivery, impacting monitoring and auditing capabilities in affected Red Hat products. Red Hat products in their default configurations will be able to automatically recover, but some log messages may be lost.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34480"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457328",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457328"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34480",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34480"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34480",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34480"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/logging-log4j2/pull/4077",
          "url": "https://github.com/apache/logging-log4j2/pull/4077"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb",
          "url": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb"
        },
        {
          "category": "external",
          "summary": "https://logging.apache.org/cyclonedx/vdr.xml",
          "url": "https://logging.apache.org/cyclonedx/vdr.xml"
        },
        {
          "category": "external",
          "summary": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout",
          "url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout"
        },
        {
          "category": "external",
          "summary": "https://logging.apache.org/security.html#CVE-2026-34480",
          "url": "https://logging.apache.org/security.html#CVE-2026-34480"
        }
      ],
      "release_date": "2026-04-10T15:42:03.843000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging"
    },
    {
      "cve": "CVE-2026-39852",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-04-13T13:26:46.572000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457819"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected endpoints. The vulnerability arises because Quarkus\u0027s security layer performs authorization checks on the raw URL path, which preserves these matrix parameters.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457819",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457819"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39852"
        },
        {
          "category": "external",
          "summary": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-rc95-pcm8-65v9",
          "url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-rc95-pcm8-65v9"
        }
      ],
      "release_date": "2026-05-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure a reverse proxy or load balancer in front of the Quarkus application to normalize incoming URL paths by stripping matrix parameters (semicolons) before requests reach the Quarkus security layer. This ensures that authorization checks are performed on the intended path. Ensure that any changes to proxy configurations are thoroughly tested and services are reloaded or restarted as necessary to apply the new settings.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests"
    },
    {
      "cve": "CVE-2026-41240",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-04-23T16:04:41.751666+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461147"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify, a DOM-only cross-site scripting sanitizer. A remote attacker could exploit an inconsistency in how forbidden tags and attributes are handled when function-based tag additions are used. This allows malicious HTML, MathML, or SVG elements to bypass sanitization and execute arbitrary code in the user\u0027s browser, leading to Cross-Site Scripting (XSS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41240"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461147",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461147"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41240",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41240"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41240",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41240"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80",
          "url": "https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.0",
          "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m"
        }
      ],
      "release_date": "2026-04-23T14:54:32.426000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization"
    },
    {
      "cve": "CVE-2026-42044",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-04-24T19:01:13.418725+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461624"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution \"Gadget\" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42044"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461624",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461624"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42044",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42044"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23"
        }
      ],
      "release_date": "2026-04-24T17:49:49.517000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget"
    },
    {
      "cve": "CVE-2026-42583",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-13T19:01:32.498598+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477219"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory (up to 32 MB per block) before the LZ4 decompression runs, leading to excessive memory consumption and a denial of service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Netty\u0027s LZ4FrameDecoder. The decoder allocates a buffer based on the decompressed length from the LZ4 frame header (up to 32 MB per block) before decompression runs. A remote attacker can send a small crafted LZ4 header (as few as 22 bytes) to force excessive memory allocation, leading to a denial of service. Red Hat products that use Netty with LZ4 compression enabled are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42583"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477219",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477219"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42583",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42583"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42583",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42583"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6"
        }
      ],
      "release_date": "2026-05-13T18:09:19.817000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder"
    },
    {
      "cve": "CVE-2026-42587",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-13T19:01:35.415881+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477220"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477220",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
        }
      ],
      "release_date": "2026-05-13T18:22:21.699000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
    },
    {
      "cve": "CVE-2026-44249",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-06-11T22:02:05.327173+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in netty-handler is rated as Important because a remote attacker can bypass configured IPv6 subnet filtering rules. This flaw, stemming from an incorrect masking operation, could allow unauthorized access to or exposure of services that are intended to be network-restricted within Red Hat products utilizing the affected Netty component.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44249",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86"
        }
      ],
      "release_date": "2026-06-11T20:46:14.110000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation"
    },
    {
      "cve": "CVE-2026-44573",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-05-13T18:01:50.343509+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477199"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Next.js. Applications utilizing the Pages Router with internationalization (i18n) configured and middleware or proxy-based authorization are susceptible to unauthorized access. A remote attacker can exploit this by making locale-less /_next/data/\u003cbuildId\u003e/\u003cpage\u003e.json requests, which bypass the intended authorization checks. This allows the attacker to retrieve sensitive server-side rendered (SSR) JSON data from protected pages, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44573"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477199",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477199"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44573",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44573"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44573",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44573"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5",
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5"
        }
      ],
      "release_date": "2026-05-13T16:48:16.218000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n"
    },
    {
      "cve": "CVE-2026-44574",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-05-13T18:02:21.088167+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477207"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Next.js. This vulnerability allows an attacker to bypass security checks in web applications that use Next.js middleware to protect specific web pages. By sending specially crafted web addresses, an attacker can access protected content without proper authorization. This could lead to unauthorized viewing of sensitive information or access to restricted features.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Next.js: Next.js: Authorization bypass via crafted query parameters",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44574"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477207",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44574",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44574"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44574",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44574"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv",
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv"
        }
      ],
      "release_date": "2026-05-13T16:56:06.008000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Next.js: Next.js: Authorization bypass via crafted query parameters"
    },
    {
      "cve": "CVE-2026-44575",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-05-13T18:01:17.168356+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477188"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Next.js. App Router applications that use middleware or proxy-based authorization checks are vulnerable to unauthorized access. A remote attacker can exploit this by crafting specific .rsc and segment-prefetch URLs, which bypass the intended middleware rules. This allows access to protected content without proper authorization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "next.js: Next.js: Unauthorized access to protected content via middleware bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44575"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477188",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477188"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44575",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44575"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44575",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44575"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f",
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f"
        }
      ],
      "release_date": "2026-05-13T16:54:39.455000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "next.js: Next.js: Unauthorized access to protected content via middleware bypass"
    },
    {
      "cve": "CVE-2026-44577",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-13T18:01:35.713847+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477194"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Next.js. When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. A remote attacker could exploit this by requesting large local assets from the /_next/image endpoint. This can lead to out-of-memory conditions, resulting in a Denial of Service (DoS) for the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Next.js: Next.js: Denial of Service via Image Optimization API",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44577"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477194",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477194"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44577"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh",
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh"
        }
      ],
      "release_date": "2026-05-13T17:00:02.786000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Next.js: Next.js: Denial of Service via Image Optimization API"
    },
    {
      "cve": "CVE-2026-44578",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-05-13T18:01:13.729805+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477187"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Next.js. Self-hosted applications utilizing the built-in Node.js server are vulnerable to Server-Side Request Forgery (SSRF) through specially crafted WebSocket upgrade requests. A remote attacker can exploit this by causing the server to proxy requests to arbitrary internal or external destinations. This could lead to the exposure of internal services or sensitive cloud metadata endpoints.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44578"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477187",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477187"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44578",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44578"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44578",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44578"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r",
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r"
        }
      ],
      "release_date": "2026-05-13T17:01:38.942000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests"
    },
    {
      "cve": "CVE-2026-44579",
      "cwe": {
        "id": "CWE-833",
        "name": "Deadlock"
      },
      "discovery_date": "2026-05-13T18:01:32.406247+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477193"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Next.js. Applications utilizing Partial Prerendering via the Cache Components feature are susceptible to connection exhaustion. A remote attacker can send crafted POST requests to a server action, triggering a request-body handling deadlock. This leaves connections open, consuming server resources and ultimately leading to a Denial of Service (DoS) for legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "next.js: Next.js: Denial of Service via crafted POST requests to server actions",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44579"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477193",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477193"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44579",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44579"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44579",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44579"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx",
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx"
        }
      ],
      "release_date": "2026-05-13T17:04:28.388000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "next.js: Next.js: Denial of Service via crafted POST requests to server actions"
    },
    {
      "cve": "CVE-2026-44893",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2026-06-12T15:01:18.066312+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488383"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44893"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488383",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488383"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44893",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44893"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv"
        }
      ],
      "release_date": "2026-06-12T14:00:25.801000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message"
    },
    {
      "cve": "CVE-2026-45109",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-05-13T18:01:23.402405+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477190"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Next.js. A remote unauthenticated attacker could exploit a bypass in a security fix when using middleware.ts with Turbopack. This vulnerability could lead to the disclosure of sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45109"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477190",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477190"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45109",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45109"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45109",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45109"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6",
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6"
        }
      ],
      "release_date": "2026-05-13T17:11:07.275000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack"
    },
    {
      "cve": "CVE-2026-45416",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-12T15:01:45.671884+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488391"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in Netty is rated as Important. It allows a remote attacker to trigger a denial of service by sending a specially crafted TLS ClientHello message. The flaw arises from an eager, unbounded memory allocation during the TLS handshake, particularly when default configurations disable the maximum client hello length guard, leading to excessive resource consumption in affected Red Hat products utilizing Netty.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488391",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45416",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"
        }
      ],
      "release_date": "2026-06-12T14:10:05.585000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure applications utilizing Netty\u0027s `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application\u0027s documentation for details on configuring Netty\u0027s TLS handler. A restart of the affected application or service is required for the configuration changes to take effect.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake"
    },
    {
      "cve": "CVE-2026-45674",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-06-12T15:02:15.565158+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488400"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses, which could enable an attacker to redirect network traffic or intercept sensitive data from affected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important severity flaw in Netty\u0027s DnsResolveContext allows a remote attacker to achieve information disclosure or data manipulation. By crafting malicious DNS responses, an attacker could redirect network traffic or intercept sensitive data, impacting applications utilizing Netty for DNS resolution in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45674"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488400",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488400"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45674",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45674"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc"
        }
      ],
      "release_date": "2026-06-12T14:17:50.203000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation"
    },
    {
      "cve": "CVE-2026-47691",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-06-12T16:02:45.855856+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488439"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Netty\u0027s DNS resolution component, `netty-resolver-dns`, allows for DNS cache poisoning. An attacker with control over an authoritative name server for a subdomain could exploit this vulnerability to inject malicious DNS records into the cache of parent domains. This could lead to redirection of network traffic, impacting the integrity and availability of services relying on DNS resolution within affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47691"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488439",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488439"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47691",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47691"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85"
        }
      ],
      "release_date": "2026-06-12T14:33:16.595000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records"
    },
    {
      "cve": "CVE-2026-48043",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-06-12T16:02:56.371830+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488442"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48043"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488442",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488442"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48043",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48043"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j"
        }
      ],
      "release_date": "2026-06-12T14:39:52.498000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak"
    },
    {
      "cve": "CVE-2026-48059",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-06-12T16:02:40.032749+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488437"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48059"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488437",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488437"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48059",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48059"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j"
        }
      ],
      "release_date": "2026-06-12T14:42:44.677000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers"
    },
    {
      "cve": "CVE-2026-50010",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-06-12T16:02:13.735675+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488429"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Netty that affects Red Hat products utilizing the `netty-handler` component, including various Red Hat AMQ, Enterprise Application Platform, and OpenShift offerings. The vulnerability arises when a Netty client is configured with a plain X.509 Trust Manager, leading to a bypass of hostname verification. This oversight allows a remote attacker to perform man-in-the-middle attacks by impersonating a legitimate server, potentially compromising sensitive data.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488429",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50010",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9"
        }
      ],
      "release_date": "2026-06-12T14:50:43.151000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass"
    },
    {
      "cve": "CVE-2026-50559",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-09T10:55:32.426000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2486959"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Quarkus. A remote attacker could bypass HTTP path-based authorization policies by using specially crafted encoded semicolons, slashes, or backslashes in HTTP requests. This could allow unauthorized access to protected static resources, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Quarkus where HTTP path-based authorization policies can be bypassed by a remote attacker. Specially crafted HTTP requests containing encoded semicolons, slashes, or backslashes can circumvent security controls, allowing unauthorized access to protected static resources and leading to information disclosure. This is critical in deployments where Quarkus applications serve sensitive static content and rely solely on path-based authorization.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50559"
        },
        {
          "category": "external",
          "summary": "RHBZ#2486959",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486959"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50559",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50559"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50559",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50559"
        },
        {
          "category": "external",
          "summary": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v",
          "url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v"
        }
      ],
      "release_date": "2026-06-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-02T00:03:15+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:34608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.