Red Hat Openshift Serverless vulnerabilities

17 CVEs affecting Red Hat Openshift Serverless, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-107174, published 2026-10-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-3653, published 2024-07-08. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler…
CVE-2024-1023, published 2024-03-27. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to…
CVE-2024-1394, published 2024-03-21. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in…
CVE-2024-3884, published 2025-12-03. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding…
CVE-2024-3727, published 2024-05-14. High severity, CVSS 8.3. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion,…
CVE-2024-11831, published 2025-02-10. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object…
CVE-2024-1300, published 2024-04-02. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate…
CVE-2026-45292, published 2026-05-28. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the…
CVE-2024-12401, published 2024-12-12. Medium severity, CVSS 4.4. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…

Latest

CVE-2026-107174, published 2026-10-07. Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious…
CVE-2026-87743, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the…
CVE-2026-0775, published 2026-01-23. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker…
CVE-2025-10894, published 2025-09-24. Critical severity, CVSS 9.6. EPSS: 0.6% chance of exploitation in the next 30 days. Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected…
CVE-2025-8556, published 2025-08-06. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point…