Red Hat OpenShift Serverless vulnerabilities

13 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Exploited Red Hat OpenShift Serverless vulnerabilities

CVE-2026-107174 — Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction (CVSS 6.4)
CVE-2025-8556 — Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results (CVSS 3.7)
CVE-2024-11831 — Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript (CVSS 5.4)
CVE-2024-12401 — Cert-manager: potential dos when parsing specially crafted pem inputs (CVSS 4.4)
CVE-2024-9355 — Golang-fips: golang fips zeroed buffer (CVSS 6.5)
CVE-2024-3653 — Undertow: learningpushhandler can lead to remote memory dos attacks (CVSS 5.3)
CVE-2024-3727 — Containers/image: digest type does not guarantee valid type (CVSS 8.3)
CVE-2023-5675 — Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used. (CVSS 6.5)
CVE-2024-1394 — Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads (CVSS 7.5)
CVE-2023-48795 — (CVSS 5.9)
CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability (CVSS 7.5) — exploited
CVE-2023-4853 — Quarkus: http security policy bypass (CVSS 8.1)
CVE-2021-3703 — (CVSS 7.5)