Red Hat Fuse
23 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Red Hat Fuse, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Red Hat Fuse CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 1 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 1 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 23 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High13
- Medium7
Latest CVEs
The 15 most recently published vulnerabilities affecting Red Hat Fuse.
- CVE-2026-27903minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments7.5
- CVE-2025-48734Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default8.8
- CVE-2024-12798JaninoEventEvaluator vulnerability7.3
- CVE-2024-6162Undertow: url-encoded request path information can be broken on ajp-listener7.5
- CVE-2024-4067Regular Expression Denial of Service in micromatch5.3
- CVE-2023-39410Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK7.5
- CVE-2023-40167Jetty accepts "+" prefixed value in Content-Length5.3
- CVE-2023-22602Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request7.5
- CVE-2022-42920Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing9.8
- CVE-2022-24823Local Information Disclosure Vulnerability in io.netty:netty-codec-http5.5
- CVE-2021-44906Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).9.8
- CVE-2020-36518jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.7.5
- CVE-2021-43797HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling6.5
- CVE-2021-37137The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was rece...7.5
- CVE-2021-38153Timing Attack Vulnerability for Apache Kafka Connect and Clients5.9
Product grouping is registry-driven, with AI assist and human review. How it works