VDB
RHSA-2025%3A3397
RHSA-2025%3A3397
PUBLISHED
CVSS 4.400000095367432 MEDIUM
A Regular Expression Denial of Service (ReDoS) vulnerability was found in the cross-spawn package for Node.js. Due to improper input sanitization, an attacker can increase CPU usage and crash the program with a large, specially crafted string.
Risk Scores
CVSS 3.1
4.400000095367432
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhoai/odh-model-registry-operator-rhel8@sha256:22557a6fa52d2f311750a9ba253860f423ba697d26efa02ef8524a8258d2a909_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-driver-rhel8@sha256:efd039012559786deb3c521a130886c265e88d635e08baace2e573a9df270134_amd64 as a component of Red Hat OpenShift AI 2.16 | registry.redhat.io/rhoai/odh-ml-pipelines-driver-rhel8@sha256:efd039012559786deb3c521a130886c265e88d635e08baace2e573a9df270134_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-notebook-controller-rhel8@sha256:4c5ff3496b2a2a739939d94ee9dafc02b682100785d228dc2fde480fb597b7a5_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8@sha256:4a212ec634225c14beac09be24ddf336e562f2aa9a13555fb1196f366ddae23c_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
| Red Hat | registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel8@sha256:f37e4048f3a152798286793f3abfc6ed814453fcbe2667255a7e78eee483c5a3_amd64 as a component of Red Hat OpenShift AI 2.16 | registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel8@sha256:f37e4048f3a152798286793f3abfc6ed814453fcbe2667255a7e78eee483c5a3_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-api-server-v2-rhel8@sha256:23d307a36b69e0df04f72a7d3b35e28d8417a8bbe23dba31e8e977569785c078_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
| Red Hat | Red Hat OpenShift AI | |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8@sha256:5192f1dbd2a9ab92ae390c4ae506efbed0970545b6122e95b014728ac937e777_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
| Red Hat | registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:c499a2c4a7860a1853adf3ebfbf154f3c03c478034a78566b82711373210af39_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
| Red Hat | registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:c499a2c4a7860a1853adf3ebfbf154f3c03c478034a78566b82711373210af39_amd64 as a component of Red Hat OpenShift AI 2.16 | registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:c499a2c4a7860a1853adf3ebfbf154f3c03c478034a78566b82711373210af39_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-model-registry-rhel8@sha256:de5f91180ead7d73a1825fe8b032fde9b8b01392569c9789f5ce1b4b9c08a98f_amd64 as a component of Red Hat OpenShift AI 2.16 | registry.redhat.io/rhoai/odh-model-registry-rhel8@sha256:de5f91180ead7d73a1825fe8b032fde9b8b01392569c9789f5ce1b4b9c08a98f_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel8@sha256:27b113d96453c2054d4c965a963d2badba6daac235eddaf23234c76e87bcb069_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
| Red Hat | registry.redhat.io/rhoai/odh-trustyai-service-rhel8@sha256:633984b538f027c93c5886ea1045dcbe81eeda74acf80001d5fc5f765bdbe0be_amd64 as a component of Red Hat OpenShift AI 2.16 | registry.redhat.io/rhoai/odh-trustyai-service-rhel8@sha256:633984b538f027c93c5886ea1045dcbe81eeda74acf80001d5fc5f765bdbe0be_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-codeflare-operator-rhel8@sha256:04f305c44413ae7dcb7017e53570ee49a509701792c5f50efadd64f47395730b_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
| Red Hat | registry.redhat.io/rhoai/odh-model-controller-rhel8@sha256:6cf74044ae8d5308a2dfe03fa5d81086c89302db7f4cdbe2f4174a1c48b77869_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
| Red Hat | registry.redhat.io/rhoai/odh-codeflare-operator-rhel8@sha256:04f305c44413ae7dcb7017e53570ee49a509701792c5f50efadd64f47395730b_amd64 as a component of Red Hat OpenShift AI 2.16 | registry.redhat.io/rhoai/odh-codeflare-operator-rhel8@sha256:04f305c44413ae7dcb7017e53570ee49a509701792c5f50efadd64f47395730b_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel8@sha256:2ba2b2c4db8bb334c50f4dfb54059f060361186900a44c06eed00b7a3c43977e_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
| Red Hat | registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8@sha256:d7d4fa406e0fcf0507894a7676532b27f45be742467e603a86f98ea5d2615df8_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
| Red Hat | registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8@sha256:ee01e89f98feb185f6cd59c564e590a13e4d8d9ea760cca8de51426eb71b83a1_amd64 as a component of Red Hat OpenShift AI 2.16 | registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8@sha256:ee01e89f98feb185f6cd59c564e590a13e4d8d9ea760cca8de51426eb71b83a1_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-trustyai-service-rhel8@sha256:633984b538f027c93c5886ea1045dcbe81eeda74acf80001d5fc5f765bdbe0be_amd64 as a component of Red Hat OpenShift AI 2.16 | *, * |
…and 35 more
Timeline
- Mar 31, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2025:3397 advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ advisory
- https://access.redhat.com/security/cve/CVE-2024-21538 advisory
- https://access.redhat.com/security/cve/CVE-2024-45296 advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://access.redhat.com/security/cve/CVE-2024-45339 advisory
- https://access.redhat.com/security/cve/CVE-2024-52798 advisory
- https://access.redhat.com/security/cve/CVE-2024-55565 advisory
- https://access.redhat.com/security/cve/CVE-2024-56171 advisory
- https://access.redhat.com/security/cve/CVE-2024-56201 advisory
- https://access.redhat.com/security/cve/CVE-2025-22150 advisory
- https://access.redhat.com/security/cve/CVE-2025-24928 advisory
- https://access.redhat.com/security/cve/CVE-2025-26791 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3397.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2324550 issue
- https://www.cve.org/CVERecord?id=CVE-2024-21538 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-21538 advisory
- https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff advisory
- https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f advisory
…and 67 more