Openshift
This hub aggregates every CVE we track for Openshift, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Operating Systemson-prem
154
CVEs tracked
11
Critical
59
High
2
In CISA KEV
Severity distribution
MEDIUM72HIGH59LOW12CRITICAL11
Monthly trend
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
2
0
0
1
2
0
0
2024-072026-06
Latest CVEs
The 15 most recently published vulnerabilities affecting Openshift.
- CVE-2026-35092Corosync: corosync: denial of service via integer overflow in join message validation7.5
- CVE-2026-35091Corosync: corosync: denial of service and information disclosure via crafted udp packet8.2
- CVE-2026-32285Denial of service in github.com/buger/jsonparser7.5
- CVE-2025-61594URI Credential Leakage Bypass over CVE-2025-272217.5
- CVE-2025-14512Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow6.5
- CVE-2024-45777Grub2: grub-core/gettext: integer overflow leads to heap oob write.6.7
- CVE-2024-12085Rsync: info leak via uninitialized stack contents7.5
- CVE-2024-1485Registry-support: decompress can delete files outside scope via relative paths8.0
- CVE-2023-44487The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.KEV7.5
- CVE-2023-24538Backticks not treated as string delimiters in html/template9.8
- CVE-2023-0229A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they c...6.3
- CVE-2023-0296The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in th...5.3
- CVE-2022-3259Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.7.4
- CVE-2022-3260The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly, allowing clickjacking attacks.4.8
- CVE-2022-3262A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an attacker to supply an incorrect name wi...8.1
Product normalization is registry-driven with AI assist and human review. How it works