Openshift Application Runtimes
80 CVEs tracked. 2 of them are in CISA KEV.
This hub aggregates every CVE we track for Openshift Application Runtimes, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Openshift Application Runtimes CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 80 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical16
- High32
- Medium28
- Low4
Latest CVEs
The 15 most recently published vulnerabilities affecting Openshift Application Runtimes.
- CVE-2023-45648Apache Tomcat: Trailer header parsing too lenient5.3
- CVE-2023-1108Undertow: infinite loop in sslconduit during close7.5
- CVE-2021-46877jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving Jso...7.5
- CVE-2023-26464Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender7.5
- CVE-2022-45047Apache MINA SSHD: Java unsafe deserialization vulnerability9.8
- CVE-2022-41854Stack Overflow in Snakeyaml5.8
- CVE-2022-38749DoS in SnakeYAML6.5
- CVE-2022-1319A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A fai...7.5
- CVE-2022-1259A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an ...7.5
- CVE-2021-3914It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks.6.1
- CVE-2021-4178A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and priv...6.7
- CVE-2021-3690A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from ...7.5
- CVE-2021-3597A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availab...5.9
- CVE-2022-24823Local Information Disclosure Vulnerability in io.netty:netty-codec-http5.5
- CVE-2020-36518jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.7.5
Product grouping is registry-driven, with AI assist and human review. How it works