VDB
RHSA-2026:70870
RHSA-2026:70870
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service (DoS) in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json runtime, leading to stack exhaustion and a process abort. This can make the affected server unavailable to legitimate users.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:00feaaf029da12a09e28f196953423442e608cdcb5c75a507fe8c97dc662e183_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:302a19cec76473554ec2157fc8cc6995eb53553954edab2c9d5dde7da36afb14_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:822e29c6b0b68079a347949167ea267b0a8627d46c901bc3c4db535abe510e72_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3f527e14b66008eadeb6af9f8a879e7b9e27dc57a5df00dd14d4f010f411cfc2_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/vector-rhel9@sha256:cca9d391f6e652dc4a5dad0184795a74a99e56a09f20cb9e3a0060b1f8ba6606_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/vector-rhel9@sha256:f9ce3dc12736c85705a7c06615830c5a931f4f610a697b16381d4ac15add56c4_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4e36e066b35f44a54674984e22b185349bf3785e6f9bc86b569ebaa59dcbd2a2_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2637f8ba12b50ec71c24bb32a18dbaf9d2fb4c34c60ee131707a5fb2b204050_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:4c370fd40f050135ce34fd3b4975986c6010868027377a41c62760efddba0c40_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:e72f4d0887e40b93bc90f7b4dfd11268ec89545c3ca88fb9f17e2b791d8e5655_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:eb39de1415d25f2d15c14d0535968ffbd2de47dcc76cbf59a223662933c72374_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cfdd5a3a9f0155fc6e95e286aab35c3f5426831cc1e721c1db3dd52ba2a98472_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:7edd996585ced7980c0361d170e4609847beee3576876d587a27af3477ebe25d_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:742550c2488970f3c86c0774d040d96c83e64bc3b78ba9be22355b3be7d5f692_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:99d11f42d86d470e4c7d7e058414391e97dbd486b65f3be5632bb1b88792c71b_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:52ed6ebbde66a133f3e493de4e70f8dfd34a530821180433ccb53e3357bac655_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:2a2a0ebc791a8c6df0587901845d99af607fff15a16f34d44d60246a1edc46ab_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2db7aa5ecc046e77ea58de7968645f27727ebd04efe106064991b3ec78592b2d_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:e317827dc1605cd47d546d144202dcd438d6d896dc555968aa898039a79ca7cd_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
| Red Hat | registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:a5e092c0dbc40b85fd7a93328c798e4721e7c059fb30b470501371149294f9b8_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.5 | *, *, * |
…and 14 more
Timeline
- Sep 23, 2026 CVE Published
- Oct 12, 2026 CVE Updated
- Oct 12, 2026 Distribution Patch
- Oct 12, 2026 Distribution Patch
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:70870 advisory
- https://access.redhat.com/security/cve/CVE-2026-18140 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-29181 advisory
- https://access.redhat.com/security/cve/CVE-2026-33818 advisory
- https://access.redhat.com/security/cve/CVE-2026-35469 advisory
- https://access.redhat.com/security/cve/CVE-2026-39829 advisory
- https://access.redhat.com/security/cve/CVE-2026-39830 advisory
- https://access.redhat.com/security/cve/CVE-2026-39831 advisory
- https://access.redhat.com/security/cve/CVE-2026-39832 advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 advisory
- https://access.redhat.com/security/cve/CVE-2026-42151 advisory
- https://access.redhat.com/security/cve/CVE-2026-42154 advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 advisory
- https://access.redhat.com/security/cve/CVE-2026-42508 advisory
- https://access.redhat.com/security/cve/CVE-2026-46595 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/cve/CVE-2026-46600 advisory
- https://access.redhat.com/security/cve/CVE-2026-46604 advisory
…and 152 more