automation-orchestrator-ui-rhel9 (js-yaml)

A denial-of-service vulnerability in YAML parsing where merge key processing bypasses configured resource limits. Updated js-yaml to version 3.15.2 / 4.3.2.

automation-orchestrator-rhel9-operator (Go)

A denial-of-service vulnerability in Go XML decoding where DecodeElement resets the recursion depth counter, allowing stack exhaustion. Updated Go standard library.

automation-orchestrator-ui-rhel9 (DOMPurify)

A cross-site scripting vulnerability in DOMPurify IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Updated DOMPurify to version 3.4.13 or later.

automation-orchestrator-ui-rhel9(js-yaml)

A denial-of-service vulnerability in js-yaml where crafted YAML documents with chained merge keys cause quadratic CPU consumption. Updated js-yaml to version 3.15.0 / 4.3.0.

automation-orchestrator-ui-rhel9 (qs)

A denial-of-service vulnerability in the qs stringify function where improper validation of the isBuffer property causes a TypeError on attacker-influenced input. Pinned qs to version 6.16.0.

automation-orchestrator-rhel9 (aiohttp)

An HTTP request-smuggling vulnerability in aiohttp server-side WebSocket upgrade parsing where the parser switches protocols before receiving the complete request body. Raised aiohttp floor to version 3.14.2.

automation-orchestrator-rhel9 (pypdf)

A denial-of-service vulnerability in pypdf where crafted indirect object tokens in PDF files could cause excessive input scanning and application unavailability.

automation-orchestrator-rhel9 (pypdf)

A denial-of-service vulnerability in pypdf where excessive memory consumption during font parsing could cause application unavailability.

automation-orchestrator-rhel9 (pypdf)

A denial-of-service vulnerability in pypdf where a crafted FlateDecode stream could force inefficient decompression and cause application unavailability.

automation-orchestrator-rhel9 (pyjwt)

A token forgery vulnerability in pyjwt where public JWK containers could be accepted as HMAC secrets, potentially allowing unauthorized token creation.

automation-orchestrator-ui-rhel9 (proxy-addr)

An IP spoofing vulnerability in proxy-addr where IPv4-mapped IPv6 trust subnets could be misconfigured, potentially allowing untrusted addresses to bypass proxy trust checks.

automation-orchestrator-ui-rhel9 (seroval)

A denial-of-service vulnerability in seroval where unbounded memory allocation during deserialization could cause application unavailability.