RHSA-2026%3A24331

RHSA-2026%3A24331 PUBLISHED CVSS 8.199999809265137 HIGH

A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.

Risk Scores

CVSS 3.1

8.199999809265137

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected Products

Vendor	Product	Versions
Red Hat	cockpit-image-builder-0:94.3-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)	94.3-1.el10
Red Hat	cockpit-image-builder-0:94.3-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)	94.3-1.el10

Timeline

Jun 8, 2026 CVE Published
Jun 23, 2026 CVE Updated
Jun 23, 2026 Distribution Patch
Jun 23, 2026 Distribution Patch
Jun 23, 2026 Security Advisory
Jun 23, 2026 Security Advisory
Jun 23, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:24331 advisory
https://access.redhat.com/security/updates/classification/#important advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2431740 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2453496 issue
https://issues.redhat.com/browse/RHEL-182455 advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24331.json advisory
https://access.redhat.com/security/cve/CVE-2025-13465 advisory
https://www.cve.org/CVERecord?id=CVE-2025-13465 advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-13465 advisory
https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg advisory
https://access.redhat.com/security/cve/CVE-2026-4800 advisory
https://www.cve.org/CVERecord?id=CVE-2026-4800 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-4800 advisory
https://cna.openjsf.org/security-advisories.html advisory
https://github.com/advisories/GHSA-35jh-r3h4-6jhm advisory
https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c advisory

Open in Interactive Console →