VDB
RHSA-2026%3A2672
RHSA-2026%3A2672
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-deployer-rhel9@sha256:cc856abcacf8a8589c8d43dbfbac377bb04e6edcd118f2fa5612d812ed394eb6_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-deployer-rhel9@sha256:cc856abcacf8a8589c8d43dbfbac377bb04e6edcd118f2fa5612d812ed394eb6_arm64, registry.redhat.io/openshift4/ose-deployer-rhel9@sha256:cc856abcacf8a8589c8d43dbfbac377bb04e6edcd118f2fa5612d812ed394eb6_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-thanos-rhel9@sha256:53405884b5e2f0029e11362ac6a83a866a46592283fb3ce61b8fee6b27a55be2_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-thanos-rhel9@sha256:53405884b5e2f0029e11362ac6a83a866a46592283fb3ce61b8fee6b27a55be2_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-configmap-reloader-rhel9@sha256:dfdd2196f7cd1170a70ff864de7dbe2d674e3a18f77db1327d517d010daa35bc_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-configmap-reloader-rhel9@sha256:dfdd2196f7cd1170a70ff864de7dbe2d674e3a18f77db1327d517d010daa35bc_ppc64le, registry.redhat.io/openshift4/ose-configmap-reloader-rhel9@sha256:dfdd2196f7cd1170a70ff864de7dbe2d674e3a18f77db1327d517d010daa35bc_ppc64le, registry.redhat.io/openshift4/ose-configmap-reloader-rhel9@sha256:dfdd2196f7cd1170a70ff864de7dbe2d674e3a18f77db1327d517d010daa35bc_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9@sha256:2ad6590f527c6c3c2a62bfd373aec2a7b718166421696bb1af8f90edab680394_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9@sha256:2ad6590f527c6c3c2a62bfd373aec2a7b718166421696bb1af8f90edab680394_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-dns-rhel9-operator@sha256:665674a1a7def872e6a30691701d79e47b600f2618d2fed2d9df83549547ed0c_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, registry.redhat.io/openshift4/ose-cluster-dns-rhel9-operator@sha256:665674a1a7def872e6a30691701d79e47b600f2618d2fed2d9df83549547ed0c_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-dns-rhel9-operator@sha256:1db01c86e86ce6521bd4f95b95b39084630945599bad9a4a037157e2b7a0a207_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel9@sha256:f3378a32724504b607b203b078da1c2bcb11b7de79df2450f6f5781c1e14f8af_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-shared-resource-rhel9@sha256:e77fa9971c0b06435001f9e46491c4f561ce05b28c7ae06a0b3bb72da1f3eb58_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-csi-driver-shared-resource-rhel9@sha256:e77fa9971c0b06435001f9e46491c4f561ce05b28c7ae06a0b3bb72da1f3eb58_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-pd-csi-driver-rhel9@sha256:e4bba34520a238b34090821c82d759f835d8439bfe057fad400578e99e9a4353_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-gcp-pd-csi-driver-rhel9@sha256:e4bba34520a238b34090821c82d759f835d8439bfe057fad400578e99e9a4353_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-openshift-apiserver-rhel9-operator@sha256:b64d0a51609639fd354f763263fcbf84ff78a8601be46f706fc1107ef2a2fe6c_s390x as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-cluster-openshift-apiserver-rhel9-operator@sha256:b64d0a51609639fd354f763263fcbf84ff78a8601be46f706fc1107ef2a2fe6c_s390x, registry.redhat.io/openshift4/ose-cluster-openshift-apiserver-rhel9-operator@sha256:b64d0a51609639fd354f763263fcbf84ff78a8601be46f706fc1107ef2a2fe6c_s390x, registry.redhat.io/openshift4/ose-cluster-openshift-apiserver-rhel9-operator@sha256:b64d0a51609639fd354f763263fcbf84ff78a8601be46f706fc1107ef2a2fe6c_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-installer-altinfra-rhel9@sha256:0672a8d9e26ed9cb41dcc31f0f43b092f6f8c8ee688b49df9f4616fafd409097_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-installer-altinfra-rhel9@sha256:0672a8d9e26ed9cb41dcc31f0f43b092f6f8c8ee688b49df9f4616fafd409097_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:6f15507bd3f92f6cf0d9fe03553648fd83984e67650c07662908a9f7042b3160_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:6f15507bd3f92f6cf0d9fe03553648fd83984e67650c07662908a9f7042b3160_s390x, * |
| Red Hat | registry.redhat.io/openshift4/ose-kube-storage-version-migrator-rhel9@sha256:a87ce547f41f0516f683fb01be9ecf41cbf47b916996419f4f40b7f00d289a9f_s390x as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-kube-storage-version-migrator-rhel9@sha256:a87ce547f41f0516f683fb01be9ecf41cbf47b916996419f4f40b7f00d289a9f_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-workload-identity-federation-webhook-rhel9@sha256:7366730f671e5ac1d5e24cea6757bfa6a640a3d77bc4ef49ecd56267d8eb68b0_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-gcp-workload-identity-federation-webhook-rhel9@sha256:7366730f671e5ac1d5e24cea6757bfa6a640a3d77bc4ef49ecd56267d8eb68b0_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:91c39a05c656097f81ad7890f7ab972ac4ca6356df128aeb3b5532bd67f15909_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:91c39a05c656097f81ad7890f7ab972ac4ca6356df128aeb3b5532bd67f15909_arm64, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:91c39a05c656097f81ad7890f7ab972ac4ca6356df128aeb3b5532bd67f15909_arm64, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:91c39a05c656097f81ad7890f7ab972ac4ca6356df128aeb3b5532bd67f15909_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-cli-rhel9@sha256:f5063f0958eb7f7b16c1832c9ba25429d66d9eba3eecefc3880a1078ece336b2_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-cli-rhel9@sha256:f5063f0958eb7f7b16c1832c9ba25429d66d9eba3eecefc3880a1078ece336b2_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-rhel9-operator@sha256:2ff39450ad07eafbe84544302c295bb1b483c87dea7e42673c39978ff72e96a8_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-dns-rhel9-operator@sha256:2511e06b09330b0d0ae6db22b48bc557dfd5beaa586249f48647d4dec5c8ce72_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-cluster-dns-rhel9-operator@sha256:2511e06b09330b0d0ae6db22b48bc557dfd5beaa586249f48647d4dec5c8ce72_ppc64le, registry.redhat.io/openshift4/ose-cluster-dns-rhel9-operator@sha256:2511e06b09330b0d0ae6db22b48bc557dfd5beaa586249f48647d4dec5c8ce72_ppc64le, registry.redhat.io/openshift4/ose-cluster-dns-rhel9-operator@sha256:2511e06b09330b0d0ae6db22b48bc557dfd5beaa586249f48647d4dec5c8ce72_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-powervs-machine-controllers-rhel9@sha256:5c41e650f99fdc09f2edb41caf1eaf99316c8ab06ab81911e7a94471da048ef0_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-powervs-machine-controllers-rhel9@sha256:5c41e650f99fdc09f2edb41caf1eaf99316c8ab06ab81911e7a94471da048ef0_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9@sha256:bd101eb02cc0138ff7e6243ecfd843bb916c0182808307e39f8d7bc6e91a6d51_s390x as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9@sha256:bd101eb02cc0138ff7e6243ecfd843bb916c0182808307e39f8d7bc6e91a6d51_s390x |
…and 1296 more
Timeline
- Feb 18, 2026 CVE Published
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- May 13, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:2672 advisory
- https://access.redhat.com/security/cve/CVE-2025-13465 advisory
- https://access.redhat.com/security/cve/CVE-2025-15284 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2672.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2431740 issue
- https://www.cve.org/CVERecord?id=CVE-2025-13465 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-13465 advisory
- https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2425946 issue
- https://www.cve.org/CVERecord?id=CVE-2025-15284 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-15284 advisory
- https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9 advisory
- https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
…and 6 more