VDB
RHSA-2025%3A3929
RHSA-2025%3A3929
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the http-proxy-middleware package. Affected versions of this package are vulnerable to denial of service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. This flaw allows an attacker to kill the Node.js process and crash the server by requesting certain paths.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:a2b20da53e3f39edef80dd421ef63ed678a412d3693f176770280726da8b8785_s390x as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:a2b20da53e3f39edef80dd421ef63ed678a412d3693f176770280726da8b8785_s390x, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:a2b20da53e3f39edef80dd421ef63ed678a412d3693f176770280726da8b8785_s390x, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:a2b20da53e3f39edef80dd421ef63ed678a412d3693f176770280726da8b8785_s390x |
| Red Hat | advanced-cluster-security/rhacs-collector-rhel8@sha256:1216828fbb569d90cd7d8e24ca031b7943b9fe8318cfc7d82afc5ca92c044242_s390x as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-collector-rhel8@sha256:1216828fbb569d90cd7d8e24ca031b7943b9fe8318cfc7d82afc5ca92c044242_s390x, *, advanced-cluster-security/rhacs-collector-rhel8@sha256:1216828fbb569d90cd7d8e24ca031b7943b9fe8318cfc7d82afc5ca92c044242_s390x |
| Red Hat | advanced-cluster-security/rhacs-rhel8-operator@sha256:f67d798d415212bccbcd0c7a7515615110fafcdb6552bbf63f450c39fe5f3995_amd64 as a component of RHACS 4.6 for RHEL 8 | *, advanced-cluster-security/rhacs-rhel8-operator@sha256:f67d798d415212bccbcd0c7a7515615110fafcdb6552bbf63f450c39fe5f3995_amd64, advanced-cluster-security/rhacs-rhel8-operator@sha256:f67d798d415212bccbcd0c7a7515615110fafcdb6552bbf63f450c39fe5f3995_amd64 |
| Red Hat | advanced-cluster-security/rhacs-operator-bundle@sha256:ffe3e5a19d00090ab1e34a263f8046d9dda5dd3eb7c3bfe7f8c523630eea2f5e_arm64 as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-operator-bundle@sha256:ffe3e5a19d00090ab1e34a263f8046d9dda5dd3eb7c3bfe7f8c523630eea2f5e_arm64, advanced-cluster-security/rhacs-operator-bundle@sha256:ffe3e5a19d00090ab1e34a263f8046d9dda5dd3eb7c3bfe7f8c523630eea2f5e_arm64, advanced-cluster-security/rhacs-operator-bundle@sha256:ffe3e5a19d00090ab1e34a263f8046d9dda5dd3eb7c3bfe7f8c523630eea2f5e_arm64 |
| Red Hat | advanced-cluster-security/rhacs-rhel8-operator@sha256:65b60da1cd8857cda94388ade34fc8d39dd5dcdaea6c9684fac00f3bbca78f45_ppc64le as a component of RHACS 4.6 for RHEL 8 | *, *, * |
| Red Hat | advanced-cluster-security/rhacs-operator-bundle@sha256:8ed7233224146a80cd6cb5eb38a0163fc97e383bb1cf1d5892a855c6910d10e6_s390x as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-operator-bundle@sha256:8ed7233224146a80cd6cb5eb38a0163fc97e383bb1cf1d5892a855c6910d10e6_s390x, *, * |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:20cf7f2dac6c78237ae330279499bfd61e1b36141450d055c8973e29f91f4d57_s390x as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:20cf7f2dac6c78237ae330279499bfd61e1b36141450d055c8973e29f91f4d57_s390x, *, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:20cf7f2dac6c78237ae330279499bfd61e1b36141450d055c8973e29f91f4d57_s390x |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:20cf7f2dac6c78237ae330279499bfd61e1b36141450d055c8973e29f91f4d57_s390x as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:20cf7f2dac6c78237ae330279499bfd61e1b36141450d055c8973e29f91f4d57_s390x, *, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:20cf7f2dac6c78237ae330279499bfd61e1b36141450d055c8973e29f91f4d57_s390x |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:6f6affe109b5a27aa482ca039e170c052aa0910fb0ea74e71d09ae721cdec774_arm64 as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:6f6affe109b5a27aa482ca039e170c052aa0910fb0ea74e71d09ae721cdec774_arm64, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:6f6affe109b5a27aa482ca039e170c052aa0910fb0ea74e71d09ae721cdec774_arm64, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:6f6affe109b5a27aa482ca039e170c052aa0910fb0ea74e71d09ae721cdec774_arm64 |
| Red Hat | advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e52a6b01bba06bcb2d72ac44086764f0f1fdff5cc509a14dc99e2f2493901d72_arm64 as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e52a6b01bba06bcb2d72ac44086764f0f1fdff5cc509a14dc99e2f2493901d72_arm64, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e52a6b01bba06bcb2d72ac44086764f0f1fdff5cc509a14dc99e2f2493901d72_arm64, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:e52a6b01bba06bcb2d72ac44086764f0f1fdff5cc509a14dc99e2f2493901d72_arm64 |
| Red Hat | advanced-cluster-security/rhacs-main-rhel8@sha256:f4e2d40b454919fbc2cbaf7c05b03ae139a91113012186742d33b43f3f06f913_s390x as a component of RHACS 4.6 for RHEL 8 | *, advanced-cluster-security/rhacs-main-rhel8@sha256:f4e2d40b454919fbc2cbaf7c05b03ae139a91113012186742d33b43f3f06f913_s390x, advanced-cluster-security/rhacs-main-rhel8@sha256:f4e2d40b454919fbc2cbaf7c05b03ae139a91113012186742d33b43f3f06f913_s390x |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b7062ee50bf674108a36d62a0cb361aefb19f02b858a00778ca81dcb648fffa6_s390x as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b7062ee50bf674108a36d62a0cb361aefb19f02b858a00778ca81dcb648fffa6_s390x, *, * |
| Red Hat | advanced-cluster-security/rhacs-collector-rhel8@sha256:1821c4889efb4760683a7eb2011273456e0290ffcdefd3f74cab8be149af6829_arm64 as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-collector-rhel8@sha256:1821c4889efb4760683a7eb2011273456e0290ffcdefd3f74cab8be149af6829_arm64, *, * |
| Red Hat | advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8fc763cbcca9cc063defc3af2ae37018e3a0b9aaf49f36ffc53574dc334fc5b8_ppc64le as a component of RHACS 4.6 for RHEL 8 | *, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8fc763cbcca9cc063defc3af2ae37018e3a0b9aaf49f36ffc53574dc334fc5b8_ppc64le, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:8fc763cbcca9cc063defc3af2ae37018e3a0b9aaf49f36ffc53574dc334fc5b8_ppc64le |
| Red Hat | advanced-cluster-security/rhacs-scanner-rhel8@sha256:82f27d7a89b86e6a8169051b4c8b73472fc31a18fc32e33e766a1acc42cb2d4c_s390x as a component of RHACS 4.6 for RHEL 8 | *, *, advanced-cluster-security/rhacs-scanner-rhel8@sha256:82f27d7a89b86e6a8169051b4c8b73472fc31a18fc32e33e766a1acc42cb2d4c_s390x |
| Red Hat | advanced-cluster-security/rhacs-main-rhel8@sha256:f4e2d40b454919fbc2cbaf7c05b03ae139a91113012186742d33b43f3f06f913_s390x as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-main-rhel8@sha256:f4e2d40b454919fbc2cbaf7c05b03ae139a91113012186742d33b43f3f06f913_s390x, advanced-cluster-security/rhacs-main-rhel8@sha256:f4e2d40b454919fbc2cbaf7c05b03ae139a91113012186742d33b43f3f06f913_s390x, * |
| Red Hat | advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:0215c995567b9d84b26c86a7b3f5188fefcc6b19c61368a7f2858f2aaf5f6272_s390x as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:0215c995567b9d84b26c86a7b3f5188fefcc6b19c61368a7f2858f2aaf5f6272_s390x, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:0215c995567b9d84b26c86a7b3f5188fefcc6b19c61368a7f2858f2aaf5f6272_s390x, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:0215c995567b9d84b26c86a7b3f5188fefcc6b19c61368a7f2858f2aaf5f6272_s390x |
| Red Hat | advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:f6c5fc651e644b281e86e029e10b9bf78bbc5622e9fa6394d28ac490fce322ae_amd64 as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:f6c5fc651e644b281e86e029e10b9bf78bbc5622e9fa6394d28ac490fce322ae_amd64, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:f6c5fc651e644b281e86e029e10b9bf78bbc5622e9fa6394d28ac490fce322ae_amd64, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:f6c5fc651e644b281e86e029e10b9bf78bbc5622e9fa6394d28ac490fce322ae_amd64 |
| Red Hat | advanced-cluster-security/rhacs-roxctl-rhel8@sha256:07555f5f5a95cfc0f52d0c4d3cdb3d2561eb2b8c0c6e2382ef509e39d26d782f_ppc64le as a component of RHACS 4.6 for RHEL 8 | *, advanced-cluster-security/rhacs-roxctl-rhel8@sha256:07555f5f5a95cfc0f52d0c4d3cdb3d2561eb2b8c0c6e2382ef509e39d26d782f_ppc64le, advanced-cluster-security/rhacs-roxctl-rhel8@sha256:07555f5f5a95cfc0f52d0c4d3cdb3d2561eb2b8c0c6e2382ef509e39d26d782f_ppc64le |
| Red Hat | advanced-cluster-security/rhacs-collector-rhel8@sha256:d516bc18fab4994a415d0a83483b0c5cb494532b69849c46794fa3a8989f014a_ppc64le as a component of RHACS 4.6 for RHEL 8 | advanced-cluster-security/rhacs-collector-rhel8@sha256:d516bc18fab4994a415d0a83483b0c5cb494532b69849c46794fa3a8989f014a_ppc64le, *, advanced-cluster-security/rhacs-collector-rhel8@sha256:d516bc18fab4994a415d0a83483b0c5cb494532b69849c46794fa3a8989f014a_ppc64le |
…and 84 more
Timeline
- Apr 15, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:3929 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.6/html/release_notes/release-notes-46 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2319884 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2355865 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3929.json advisory
- https://access.redhat.com/security/cve/CVE-2024-21536 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-21536 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-21536 advisory
- https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a advisory
- https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5 advisory
- https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22 advisory
- https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906 advisory
- https://access.redhat.com/security/cve/CVE-2024-57083 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-57083 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-57083 advisory
- https://github.com/Redocly/redoc/issues/2499 advisory
- https://access.redhat.com/security/cve/CVE-2025-30204 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-30204 advisory
…and 4 more