VDB
RHSA-2026%3A3825
RHSA-2026%3A3825
PUBLISHED
CVSS 8.699999809265137 HIGH
A flaw was found in node-forge. This vulnerability allows unauthenticated attackers to bypass downstream cryptographic verifications and security decisions via crafting ASN.1 (Abstract Syntax Notation One) structures to desynchronize schema validations, yielding a semantic divergence.
Risk Scores
CVSS 3.1
8.699999809265137
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-controller-rhel9@sha256:147e26fd0d2470145f4acf8c833ac329b7e288ba1d20f491a89ab1aa3cd39c55_s390x as a component of Red Hat OpenShift Pipelines 1.2 | *, registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-controller-rhel9@sha256:147e26fd0d2470145f4acf8c833ac329b7e288ba1d20f491a89ab1aa3cd39c55_s390x, registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-controller-rhel9@sha256:147e26fd0d2470145f4acf8c833ac329b7e288ba1d20f491a89ab1aa3cd39c55_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-controller-rhel9@sha256:52772f57e167aaf6e54dc104b57a03db4fbbac7fddd65cf54a8b342cf43df20c_arm64 as a component of Red Hat OpenShift Pipelines 1.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9@sha256:7cd03b4ff79625bc11db9340e69416320b880444c91def4d0768c7b687acc576_s390x as a component of Red Hat OpenShift Pipelines 1.2 | |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:35412516c9d8d4ddb93f57bb59da160aa6abb11581a1a5df793fcbb8197f2e4f_s390x as a component of Red Hat OpenShift Pipelines 1.2 | *, registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:35412516c9d8d4ddb93f57bb59da160aa6abb11581a1a5df793fcbb8197f2e4f_s390x, registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:35412516c9d8d4ddb93f57bb59da160aa6abb11581a1a5df793fcbb8197f2e4f_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel9@sha256:6c9c4245686d29afb7f5285e3085969e2ec5283e5bf92bcfb8bc6cae13027724_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel9@sha256:6c9c4245686d29afb7f5285e3085969e2ec5283e5bf92bcfb8bc6cae13027724_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel9@sha256:6c9c4245686d29afb7f5285e3085969e2ec5283e5bf92bcfb8bc6cae13027724_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel9@sha256:6c9c4245686d29afb7f5285e3085969e2ec5283e5bf92bcfb8bc6cae13027724_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-webhook-rhel9@sha256:1bbbf713c2ff1870779a9b18b3607f0b0a84e7a797a409ab53afe0075da3e7fb_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-webhook-rhel9@sha256:1bbbf713c2ff1870779a9b18b3607f0b0a84e7a797a409ab53afe0075da3e7fb_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-webhook-rhel9@sha256:1bbbf713c2ff1870779a9b18b3607f0b0a84e7a797a409ab53afe0075da3e7fb_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-webhook-rhel9@sha256:1bbbf713c2ff1870779a9b18b3607f0b0a84e7a797a409ab53afe0075da3e7fb_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-workingdirinit-rhel9@sha256:677cc576f84ceaba881313e7da183c012b03c4218f9a36f8d2b68806abb8b38d_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | *, *, registry.redhat.io/openshift-pipelines/pipelines-workingdirinit-rhel9@sha256:677cc576f84ceaba881313e7da183c012b03c4218f9a36f8d2b68806abb8b38d_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:6a0d1f472283c686e438dbfbeec826db9d7d95f45f92842c4073f70704860d2f_amd64 as a component of Red Hat OpenShift Pipelines 1.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:fd5188add10e6586b188efaa19ce094daf5c5c84b07725031d25237c2e93ced2_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:fd5188add10e6586b188efaa19ce094daf5c5c84b07725031d25237c2e93ced2_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:fd5188add10e6586b188efaa19ce094daf5c5c84b07725031d25237c2e93ced2_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:fd5188add10e6586b188efaa19ce094daf5c5c84b07725031d25237c2e93ced2_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:120d93e1cf2a96bfa9d7745b88377651055ebe5595f68b7b4a4bb26f633e8611_arm64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:120d93e1cf2a96bfa9d7745b88377651055ebe5595f68b7b4a4bb26f633e8611_arm64, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:120d93e1cf2a96bfa9d7745b88377651055ebe5595f68b7b4a4bb26f633e8611_arm64, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:120d93e1cf2a96bfa9d7745b88377651055ebe5595f68b7b4a4bb26f633e8611_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-results-retention-policy-agent-rhel9@sha256:ed58fd6de76c840d4057e6f89918e737ce5767a71aefb9effbdf5e9de97bb514_arm64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-results-retention-policy-agent-rhel9@sha256:ed58fd6de76c840d4057e6f89918e737ce5767a71aefb9effbdf5e9de97bb514_arm64, *, registry.redhat.io/openshift-pipelines/pipelines-results-retention-policy-agent-rhel9@sha256:ed58fd6de76c840d4057e6f89918e737ce5767a71aefb9effbdf5e9de97bb514_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9@sha256:2e507b647ca536325992fdd04d046ef960f5b5c3692af18344f86daa09a3741d_s390x as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9@sha256:2e507b647ca536325992fdd04d046ef960f5b5c3692af18344f86daa09a3741d_s390x, registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9@sha256:2e507b647ca536325992fdd04d046ef960f5b5c3692af18344f86daa09a3741d_s390x, registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9@sha256:2e507b647ca536325992fdd04d046ef960f5b5c3692af18344f86daa09a3741d_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pruner-controller-rhel9@sha256:ea04b84821f819c6be84ed2b7113b791722aa6cdfd6fe6a119d13120dbc4bc9d_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:d7a11116dca914c661bbe20ecffe56afe6011fae809845859a4ffa2884e4f7db_amd64 as a component of Red Hat OpenShift Pipelines 1.2 | *, registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:d7a11116dca914c661bbe20ecffe56afe6011fae809845859a4ffa2884e4f7db_amd64, registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:d7a11116dca914c661bbe20ecffe56afe6011fae809845859a4ffa2884e4f7db_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:b9a9eb524b522e4c6cfc285dd115fd3e0cd7d6268213db3bc066b64a7889e7b0_arm64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:b9a9eb524b522e4c6cfc285dd115fd3e0cd7d6268213db3bc066b64a7889e7b0_arm64, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:b9a9eb524b522e4c6cfc285dd115fd3e0cd7d6268213db3bc066b64a7889e7b0_arm64, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:b9a9eb524b522e4c6cfc285dd115fd3e0cd7d6268213db3bc066b64a7889e7b0_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:8559603458387b13ca544bf7a499fdaad82d18145b612e4e220e53480960dda0_s390x as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:8559603458387b13ca544bf7a499fdaad82d18145b612e4e220e53480960dda0_s390x, *, registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:8559603458387b13ca544bf7a499fdaad82d18145b612e4e220e53480960dda0_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9@sha256:253ce9e4ce0dc0045de38340fe487c9dc47b2691befe2ea91e46cc493c6a74f2_s390x as a component of Red Hat OpenShift Pipelines 1.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-sidecarlogresults-rhel9@sha256:ad84f6f7bde148dd49f9d633c4b904e52120d293aabd85eed9783f37db0de73e_s390x as a component of Red Hat OpenShift Pipelines 1.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:99346560c0fcba5270027aca813dab94e862a8c1bb413bf233c53b0488bf1339_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:99346560c0fcba5270027aca813dab94e862a8c1bb413bf233c53b0488bf1339_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:99346560c0fcba5270027aca813dab94e862a8c1bb413bf233c53b0488bf1339_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-manual-approval-gate-webhook-rhel9@sha256:99346560c0fcba5270027aca813dab94e862a8c1bb413bf233c53b0488bf1339_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:b6fb02867ebc3be24c68dd24c9178ed17a655a20aa19d477954aae0896c53213_arm64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:b6fb02867ebc3be24c68dd24c9178ed17a655a20aa19d477954aae0896c53213_arm64, registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:b6fb02867ebc3be24c68dd24c9178ed17a655a20aa19d477954aae0896c53213_arm64, registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:b6fb02867ebc3be24c68dd24c9178ed17a655a20aa19d477954aae0896c53213_arm64 |
…and 217 more
Timeline
- Mar 5, 2026 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:3825 advisory
- https://access.redhat.com/security/cve/CVE-2025-12816 advisory
- https://access.redhat.com/security/cve/CVE-2025-13465 advisory
- https://access.redhat.com/security/cve/CVE-2025-15284 advisory
- https://access.redhat.com/security/cve/CVE-2025-66506 advisory
- https://access.redhat.com/security/cve/CVE-2025-66564 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3825.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2417097 issue
- https://www.cve.org/CVERecord?id=CVE-2025-12816 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-12816 advisory
- https://github.com/digitalbazaar/forge advisory
- https://github.com/digitalbazaar/forge/pull/1124 advisory
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq advisory
- https://kb.cert.org/vuls/id/521113 advisory
- https://www.npmjs.com/package/node-forge advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2431740 issue
- https://www.cve.org/CVERecord?id=CVE-2025-13465 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-13465 advisory
…and 16 more