What’s Vulnerable › Products

Red Hat OpenShift Dev Spaces vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your Red Hat OpenShift Dev Spaces version is affected

Latest Red Hat OpenShift Dev Spaces vulnerabilities

• CVE-2026-114236 — Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers (CVSS 3.3)
• CVE-2026-107935 — Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose (CVSS 9.3)
• CVE-2026-91147 — Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash (CVSS 5.9)
• CVE-2026-91142 — Cockpit: cockpit: unauthorized modification of login records via integer overflow (CVSS 3.6)
• CVE-2026-87743 — Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security (CVSS 7.5)
• CVE-2025-11395 — Podman: arbitrary file write when importing oci archive (CVSS 5.5)
• CVE-2026-79705 — Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers (CVSS 4.5)
• CVE-2026-79699 — Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory (CVSS 4.4)
• CVE-2025-11065 — Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure (CVSS 5.3)
• CVE-2025-57850 — Codeready-ws: privilege escalation via excessive /etc/passwd permissions (CVSS 6.4)
• CVE-2024-11831 — Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript (CVSS 5.4)
• CVE-2024-3727 — Containers/image: digest type does not guarantee valid type (CVSS 8.3)
• CVE-2024-1394 — Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads (CVSS 7.5)