Known vulnerabilities in Red Hat Cryostat 4 on RHEL 9

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-42587	Netty is an asynchronous, event-driven network application framework	7.5 High	May 13, 2026
CVE-2026-42584	Netty is an asynchronous, event-driven network application framework	7.3 High	May 13, 2026
CVE-2026-42579	Netty is an asynchronous, event-driven network application framework	7.5 High	May 13, 2026
CVE-2026-42578	Netty is an asynchronous, event-driven network application framework	2.9 Low	May 13, 2026
CVE-2026-42581	Netty is an asynchronous, event-driven network application framework	5.8 Medium	May 13, 2026
CVE-2026-33811	When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…	7.5 High	May 7, 2026
CVE-2026-39852	Quarkus is a Java framework for building cloud-native applications	8.8 High	May 5, 2026
CVE-2026-43869	Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift	Not rated	May 5, 2026
CVE-2025-48431	Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings	Not rated	Apr 28, 2026
CVE-2026-40895	follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows…	6.9 Medium	Apr 21, 2026
CVE-2026-32280	During chain building, the amount of work that is done is not correctly limited when a large number of intermediate…	7.5 High	Apr 8, 2026
CVE-2026-32283	If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…	7.5 High	Apr 8, 2026
CVE-2026-33810	When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to…	7.5 High	Apr 8, 2026
CVE-2026-33815	Memory-safety vulnerability in github.com/jackc/pgx/v5	9.8 Critical	Apr 7, 2026
CVE-2026-33816	Memory-safety vulnerability in github.com/jackc/pgx/v5	9.8 Critical	Apr 7, 2026
CVE-2026-34986	Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including…	7.5 High	Apr 6, 2026
CVE-2026-4800	The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same…	8.1 High	Mar 31, 2026
CVE-2026-33871	Netty is an asynchronous, event-driven network application framework	8.7 High	Mar 27, 2026
CVE-2026-33870	Netty is an asynchronous, event-driven network application framework	7.5 High	Mar 27, 2026
CVE-2026-4926	Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace…	7.5 High	Mar 26, 2026
CVE-2026-33186	gRPC-Go is the Go language implementation of gRPC	9.1 Critical	Mar 20, 2026
CVE-2026-2229	ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of…	7.5 High	Mar 12, 2026
CVE-2026-1528	ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length	7.5 High	Mar 12, 2026
CVE-2026-1526	The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during…	7.5 High	Mar 12, 2026
CVE-2026-25679	url.Parse insufficiently validated the host/authority component and accepted some invalid URLs	7.5 High	Mar 6, 2026

Other Red Hat products