VDB
RHSA-2026%3A5174
RHSA-2026%3A5174
PUBLISHED
CVSS 7.5 HIGH
A denial of service flaw has been discovered in the Axios npm package. the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel9@sha256:cb234cf1c44de4b0b0713b2792e06e115830b115d540b494baccad28139b4fd2_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel9@sha256:cb234cf1c44de4b0b0713b2792e06e115830b115d540b494baccad28139b4fd2_amd64, registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel9@sha256:cb234cf1c44de4b0b0713b2792e06e115830b115d540b494baccad28139b4fd2_amd64, registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel9@sha256:cb234cf1c44de4b0b0713b2792e06e115830b115d540b494baccad28139b4fd2_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-kube-storage-version-migrator-rhel9@sha256:a5c0bd42f2ffe7c2d87f8c5ecb5910a64bb63bdceac83669cb38b5180907e052_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-kube-storage-version-migrator-rhel9@sha256:a5c0bd42f2ffe7c2d87f8c5ecb5910a64bb63bdceac83669cb38b5180907e052_arm64, registry.redhat.io/openshift4/ose-kube-storage-version-migrator-rhel9@sha256:a5c0bd42f2ffe7c2d87f8c5ecb5910a64bb63bdceac83669cb38b5180907e052_arm64, registry.redhat.io/openshift4/ose-kube-storage-version-migrator-rhel9@sha256:a5c0bd42f2ffe7c2d87f8c5ecb5910a64bb63bdceac83669cb38b5180907e052_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-controller-manager-rhel9@sha256:30ce84b72533a1bafc328c4fa4cd97eeb4491e235cba8fff6c48756dab8e8271_s390x as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-openshift-controller-manager-rhel9@sha256:30ce84b72533a1bafc328c4fa4cd97eeb4491e235cba8fff6c48756dab8e8271_s390x, registry.redhat.io/openshift4/ose-openshift-controller-manager-rhel9@sha256:30ce84b72533a1bafc328c4fa4cd97eeb4491e235cba8fff6c48756dab8e8271_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-ironic-machine-os-downloader-rhel9@sha256:98c91c5062e8d7e164e71ba67cf154a2e7ebd7de83a65f622c3cefcff573e9e4_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-ironic-machine-os-downloader-rhel9@sha256:98c91c5062e8d7e164e71ba67cf154a2e7ebd7de83a65f622c3cefcff573e9e4_amd64, registry.redhat.io/openshift4/ose-ironic-machine-os-downloader-rhel9@sha256:98c91c5062e8d7e164e71ba67cf154a2e7ebd7de83a65f622c3cefcff573e9e4_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator@sha256:f54b6da4bb411f5fdeec587f959111281be96f9652076c9fe913dde3e0942216_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator@sha256:f54b6da4bb411f5fdeec587f959111281be96f9652076c9fe913dde3e0942216_amd64, registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator@sha256:f54b6da4bb411f5fdeec587f959111281be96f9652076c9fe913dde3e0942216_amd64, registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator@sha256:f54b6da4bb411f5fdeec587f959111281be96f9652076c9fe913dde3e0942216_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-baremetal-operator-rhel9@sha256:66b6fd4e62537ca3252f72fad3807c10bb3d32dcc535e84f7c80d7cca1f12cf3_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-cluster-baremetal-operator-rhel9@sha256:66b6fd4e62537ca3252f72fad3807c10bb3d32dcc535e84f7c80d7cca1f12cf3_ppc64le, *, registry.redhat.io/openshift4/ose-cluster-baremetal-operator-rhel9@sha256:66b6fd4e62537ca3252f72fad3807c10bb3d32dcc535e84f7c80d7cca1f12cf3_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-rhel9-operator@sha256:5251c3ad369f33e07c6e24f482c562edce287bdae6b8e505ecb8d3cf09fc32be_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-prometheus-rhel9-operator@sha256:5251c3ad369f33e07c6e24f482c562edce287bdae6b8e505ecb8d3cf09fc32be_amd64, registry.redhat.io/openshift4/ose-prometheus-rhel9-operator@sha256:5251c3ad369f33e07c6e24f482c562edce287bdae6b8e505ecb8d3cf09fc32be_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-kube-state-metrics-rhel9@sha256:922f2719d99173cc43cc0c575706dfdf0b18d04fbbebfa361f3b8da58c00a5ec_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-kube-state-metrics-rhel9@sha256:922f2719d99173cc43cc0c575706dfdf0b18d04fbbebfa361f3b8da58c00a5ec_ppc64le, registry.redhat.io/openshift4/ose-kube-state-metrics-rhel9@sha256:922f2719d99173cc43cc0c575706dfdf0b18d04fbbebfa361f3b8da58c00a5ec_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-cni-microshift-rhel9@sha256:43b10a72c5d7f3e182414dc3edebe2ebeeb2a4af0c4349a65e49e5bb1a789ba2_s390x as a component of Red Hat OpenShift Container Platform 4.21 | *, *, registry.redhat.io/openshift4/ose-multus-cni-microshift-rhel9@sha256:43b10a72c5d7f3e182414dc3edebe2ebeeb2a4af0c4349a65e49e5bb1a789ba2_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-vsphere-problem-detector-rhel9@sha256:37bffa4965d7ec59ecbfe8abf0a23d1e0411f9445c27237f9ca923cd1b96cb66_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-vsphere-problem-detector-rhel9@sha256:37bffa4965d7ec59ecbfe8abf0a23d1e0411f9445c27237f9ca923cd1b96cb66_amd64, registry.redhat.io/openshift4/ose-vsphere-problem-detector-rhel9@sha256:37bffa4965d7ec59ecbfe8abf0a23d1e0411f9445c27237f9ca923cd1b96cb66_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel9@sha256:ab0b0d0164deea8407004db4c43be6d6626fcb35dee99f9a75e2fd5bfca244b9_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel9@sha256:ab0b0d0164deea8407004db4c43be6d6626fcb35dee99f9a75e2fd5bfca244b9_amd64, registry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel9@sha256:ab0b0d0164deea8407004db4c43be6d6626fcb35dee99f9a75e2fd5bfca244b9_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-operator-marketplace-rhel9@sha256:02e33310f537d87191e72aa16de4bc7bbedcead6befdf0e686f9d08005df3872_s390x as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-operator-marketplace-rhel9@sha256:02e33310f537d87191e72aa16de4bc7bbedcead6befdf0e686f9d08005df3872_s390x, * |
| Red Hat | registry.redhat.io/openshift4/ose-console-rhel9@sha256:f74d2a1cde5b1ad9da59a8ecd9b81f86aae535ec800c116bb3d160fb81961ba4_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-console-rhel9@sha256:f74d2a1cde5b1ad9da59a8ecd9b81f86aae535ec800c116bb3d160fb81961ba4_arm64, registry.redhat.io/openshift4/ose-console-rhel9@sha256:f74d2a1cde5b1ad9da59a8ecd9b81f86aae535ec800c116bb3d160fb81961ba4_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-baremetal-operator-rhel9@sha256:47a0e0bcec249f6ed2003797f66ce095128fb8115326a7d0ef41d528e2445213_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-cluster-baremetal-operator-rhel9@sha256:47a0e0bcec249f6ed2003797f66ce095128fb8115326a7d0ef41d528e2445213_amd64, *, registry.redhat.io/openshift4/ose-cluster-baremetal-operator-rhel9@sha256:47a0e0bcec249f6ed2003797f66ce095128fb8115326a7d0ef41d528e2445213_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-snapshot-metadata-rhel9@sha256:6fa875bee4fc70d30398f87be115e6e3c9574e5cdd469371589d55eff70ab5cf_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-csi-external-snapshot-metadata-rhel9@sha256:6fa875bee4fc70d30398f87be115e6e3c9574e5cdd469371589d55eff70ab5cf_ppc64le, registry.redhat.io/openshift4/ose-csi-external-snapshot-metadata-rhel9@sha256:6fa875bee4fc70d30398f87be115e6e3c9574e5cdd469371589d55eff70ab5cf_ppc64le, registry.redhat.io/openshift4/ose-csi-external-snapshot-metadata-rhel9@sha256:6fa875bee4fc70d30398f87be115e6e3c9574e5cdd469371589d55eff70ab5cf_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-network-interface-bond-cni-rhel9@sha256:cd11a61958693a33f6c1013c564a2ea8adb25cb0a2791c22ed862db7f14d06cd_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, *, registry.redhat.io/openshift4/ose-network-interface-bond-cni-rhel9@sha256:cd11a61958693a33f6c1013c564a2ea8adb25cb0a2791c22ed862db7f14d06cd_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-config-rhel9-operator@sha256:ff132632ffb2f87746e79787cac21fba12a9862a707885dbe9ccf95f2b388941_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-cluster-config-rhel9-operator@sha256:ff132632ffb2f87746e79787cac21fba12a9862a707885dbe9ccf95f2b388941_amd64, *, registry.redhat.io/openshift4/ose-cluster-config-rhel9-operator@sha256:ff132632ffb2f87746e79787cac21fba12a9862a707885dbe9ccf95f2b388941_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-operator-registry-rhel9@sha256:5d8e93e5f498d9d364e8b50c6f6c5c70d1ac9f1506b99629ff185abf6b28d608_s390x as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-operator-registry-rhel9@sha256:5d8e93e5f498d9d364e8b50c6f6c5c70d1ac9f1506b99629ff185abf6b28d608_s390x, *, registry.redhat.io/openshift4/ose-operator-registry-rhel9@sha256:5d8e93e5f498d9d364e8b50c6f6c5c70d1ac9f1506b99629ff185abf6b28d608_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-kubevirt-cloud-controller-manager-rhel9@sha256:0b83daa834cf9df259d8fd475c2678d92c6dd44ed697a96c24ac8921a972b58f_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-kubevirt-cloud-controller-manager-rhel9@sha256:0b83daa834cf9df259d8fd475c2678d92c6dd44ed697a96c24ac8921a972b58f_arm64, registry.redhat.io/openshift4/ose-kubevirt-cloud-controller-manager-rhel9@sha256:0b83daa834cf9df259d8fd475c2678d92c6dd44ed697a96c24ac8921a972b58f_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-scheduler-rhel9-operator@sha256:7df58145a95adeb913b9cbca82da8ae856a10b3de5ed25e170fd7af9c80afdd7_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, *, * |
…and 619 more
Timeline
- Mar 24, 2026 CVE Published
- May 4, 2026 Distribution Patch
- May 4, 2026 Distribution Patch
- May 4, 2026 Security Advisory
- May 4, 2026 Security Advisory
- May 13, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:5174 advisory
- https://access.redhat.com/security/cve/CVE-2026-25639 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5174.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2438237 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25639 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25639 advisory
- https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57 advisory
- https://github.com/axios/axios/releases/tag/v1.13.5 advisory
- https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433 advisory