VDB
RHSA-2026:57487
RHSA-2026:57487
PUBLISHED
CVSS 7.099999904632568 HIGH
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-node-exporter-rhel9@sha256:c5360921979ee9f134cc7e2da75e9538c54c05fff5d1259da708b13676971c2f_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-tests-rhel9@sha256:56f267f58d63c47337a8d7406f2d6f40a3d5f895e3401e39e37625db6c891438_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-apiserver-rhel9@sha256:d81f2843c0e8b40df02b2c9c03b40e17e6d9d6e858dede90e2151283506ddae2_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator@sha256:06902decb1271ae12c3ceb7c39ae0a56be919ce844ea9e8c4c607da587f8162f_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-olm-operator-controller-rhel9@sha256:bb46ed444f69a1b0856c3166dbfddbd3acf6577dc3e102b36d34995873747009_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:77050a5a236bfdbdd5cbee32e280e12a750827687d244d30d42a104c9f7b9914_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-scheduler-rhel9-operator@sha256:20efeaba2287b19f108260c41caa1c18eda5ad44939e1150572956b58157454c_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-marketplace-rhel9@sha256:fe09da54270fa587ae3a9b2eae8f03cb77c0167755c3013363ed6718f91dc311_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-etcd-rhel9@sha256:2ae4a5e44d8841496b83fbf34eaa3f310dba2b5c9d69a7c52f3fdfcb0e270f85_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-dns-rhel9-operator@sha256:4b81d38555e5dcd1ae250adc270deed154e1888bd1dbd1c886ed9ca794ea746a_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-apiserver-rhel9-operator@sha256:e3898788730c160654a87224f45706f97b8050a564be2a170fac6e3af49ad7ea_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:4dcf65f43058777254c254b7ab54e05d9da6dd9459235e3d183dc6c6e76e8fc3_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9-operator@sha256:84f69c42dd75c88e73978f1824bb7730e484e190ba0c401908ca622ddd9e32b0_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel9@sha256:16fdf23f6466ad0fd01e243ad367142f156e2d15d7c52b5ffd6bbd2da0beedef_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-kube-proxy-rhel9@sha256:44b4bacd10d6ec05f156e767f2001fb0c4309ea81a56583d56024ab11a7875cf_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-coredns-rhel9@sha256:9d29b79066117dfe83efd6780dde2c301164a7e2642c77fd33bb04671efded5d_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-lifecycle-manager-rhel9@sha256:57c249c79d13a7b44a6a005140e048612153fc9995604fd6f86273d6cc7ad20e_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:c1067982f6707f1e5b34d84342c459faff50d7022f86108d8a9ace5a799a4105_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-marketplace-rhel9@sha256:eb08d06fe6aea6e34a27dc13c2e6fb9128e8fb06148f01016a61e344501dd35d_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9@sha256:eae8458002e8d8c62263ac02919d70dbeef72bb407b03e0907691bfee5780a55_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | * |
…and 639 more
Timeline
- Aug 26, 2026 CVE Published
- Sep 24, 2026 CVE Updated
- Sep 24, 2026 Distribution Patch
- Sep 24, 2026 Distribution Patch
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:57487 advisory
- https://access.redhat.com/security/cve/CVE-2025-13465 advisory
- https://access.redhat.com/security/cve/CVE-2026-34986 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/cve/CVE-2026-42504 advisory
- https://access.redhat.com/security/cve/CVE-2026-44292 advisory
- https://access.redhat.com/security/cve/CVE-2026-44293 advisory
- https://access.redhat.com/security/cve/CVE-2026-6322 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57487.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2431740 issue
- https://www.cve.org/CVERecord?id=CVE-2025-13465 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-13465 advisory
- https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2466684 issue
- https://www.cve.org/CVERecord?id=CVE-2026-6322 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6322 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc advisory
…and 33 more