Vulnerabilities of Red Hat OpenShift Service Mesh 2

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-47220	Envoy is an open source edge and service proxy designed for cloud-native applications	7.5 High	Jun 26, 2026
CVE-2026-27145	(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…	6.5 Medium	Jun 2, 2026
CVE-2024-52011	launch-editor allows users to open files with line numbers in editor from Node.js	7.5 High	Jun 1, 2026
CVE-2026-45736	ws is an open source WebSocket client and server for Node.js	4.4 Medium	May 15, 2026
CVE-2026-42264	Axios is a promise based HTTP client for the browser and Node.js	7.4 High	May 8, 2026
CVE-2026-33811	When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…	7.5 High	May 7, 2026
CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion…	7.5 High	May 7, 2026
CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322	7.5 High	May 7, 2026
CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it…	7.5 High	May 7, 2026
CVE-2026-43869	Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift	Not rated	May 5, 2026
CVE-2026-42154	Prometheus is an open-source monitoring system and time series database	7.5 High	May 4, 2026
CVE-2026-42151	Prometheus is an open-source monitoring system and time series database	7.5 High	May 4, 2026
CVE-2026-41607	Out-of-bounds Read vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41606	Uncontrolled Recursion vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41605	Integer Overflow or Wraparound vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41604	Out-of-bounds Read vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41603	Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41602	Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue…	Not rated	Apr 28, 2026
CVE-2025-48431	Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings	Not rated	Apr 28, 2026
CVE-2025-62718	Axios is a promise based HTTP client for the browser and Node.js	6.3 Medium	Apr 9, 2026
CVE-2026-32280	During chain building, the amount of work that is done is not correctly limited when a large number of intermediate…	7.5 High	Apr 8, 2026
CVE-2026-27140	SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution…	8.8 High	Apr 8, 2026
CVE-2026-32283	If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…	7.5 High	Apr 8, 2026
CVE-2026-33810	When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to…	7.5 High	Apr 8, 2026
CVE-2026-34986	Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including…	7.5 High	Apr 6, 2026

Other Red Hat products