Openshift Serverless
Monthly
Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the security matcher treats as public while the dispatcher routes it to a protected endpoint, bypassing path-based authorization and reading sensitive data (CVSS 3.1 7.5, C:H/I:N/A:N). This affects deployments that rely on Quarkus HTTP security path-pattern policies to gate confidential endpoints; applications using only handler-level role or annotation checks are not bypassed this way. No public exploit identified at time of analysis.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Symbolic-link traversal during archive unpacking in Red Hat's source-to-image (S2I) tooling lets an attacker who can supply or otherwise influence the builder image consumed by a build create links that resolve to absolute paths outside the extraction directory, allowing file reads or modifications beyond the intended sandbox on the host. The flaw is rated CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), so exploitation is not an unauthenticated drive-by: the attacker needs the privileges required to introduce or reference a malicious builder image, and only environments that run S2I builds against untrusted or attacker-influenced images are realistically exposed. The scope is marked Changed because the payload escapes the build container boundary, but confidentiality and integrity impact are each only Low; no public exploit code and no confirmed active exploitation were identified at time of analysis.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the security matcher treats as public while the dispatcher routes it to a protected endpoint, bypassing path-based authorization and reading sensitive data (CVSS 3.1 7.5, C:H/I:N/A:N). This affects deployments that rely on Quarkus HTTP security path-pattern policies to gate confidential endpoints; applications using only handler-level role or annotation checks are not bypassed this way. No public exploit identified at time of analysis.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Symbolic-link traversal during archive unpacking in Red Hat's source-to-image (S2I) tooling lets an attacker who can supply or otherwise influence the builder image consumed by a build create links that resolve to absolute paths outside the extraction directory, allowing file reads or modifications beyond the intended sandbox on the host. The flaw is rated CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), so exploitation is not an unauthenticated drive-by: the attacker needs the privileges required to introduce or reference a malicious builder image, and only environments that run S2I builds against untrusted or attacker-influenced images are realistically exposed. The scope is marked Changed because the payload escapes the build container boundary, but confidentiality and integrity impact are each only Low; no public exploit code and no confirmed active exploitation were identified at time of analysis.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.