Security

In Faraday versions from 1.0.0 before 1.10.6, and 2.0.0 before 2.14.3 a high severity vulnerability CVE-2026-54297 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) condition through stack exhaustion. This occurs due to an uncontrolled recursion flaw within Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder. Because the library decodes nested query strings without enforcing a maximum nesting depth, an attacker can supply a specially crafted, deeply nested query string. When Faraday builds this into a Ruby Hash structure, the internal dehash routine recursively walks it without a depth limit. At a sufficient depth, this triggers an uncaught SystemStackError (stack level too deep), effectively crashing the calling thread or worker. To address this issue, users should upgrade Faraday to versions 1.10.6, 2.14.3, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-54297.

In FreeIPA versions prior to 4.13.3 a high severity vulnerability CVE-2026-11861 was detected. This vulnerability allows an authenticated Active Directory user to bypass authentication for FreeIPA services and escalate their privileges within the FreeIPA domain. This occurs when a trust relationship is configured between FreeIPA and Active Directory. Because FreeIPA services fail to properly verify Privilege Attribute Certificate (PAC) certificates, an attacker can impersonate a client name in the Ticket Granting Service (TGS). This enables unauthorized access to critical infrastructure components, including the portal, SMB server, and LDAP directory. To address this issue, users should upgrade FreeIPA to version 4.13.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11861.

In FreeIPA versions prior to 4.13.3 a high severity vulnerability CVE-2026-73198 was detected. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) condition through memory exhaustion. This occurs due to an unbounded request body read flaw within the /ipa/i18n_messages endpoint. By sending an arbitrarily large request body to this endpoint, an attacker can force the service to consume excessive memory. This leads to degraded responsiveness and ultimately makes the service unavailable to legitimate users. To address this issue, users should upgrade FreeIPA to version 4.13.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-73198.

In Keycloak affected versions a low severity vulnerability CVE-2026-101333 was detected. This vulnerability allows an unauthenticated attacker to cause excessive memory consumption, potentially leading to a denial of service. To address this issue, users should upgrade Keycloak to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-101333.

In Keycloak affected versions a medium severity vulnerability CVE-2026-97311 was detected. This vulnerability allows an attacker to bypass group visibility permissions. To address this issue, users should upgrade Keycloak to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-97311.

In OpenVPN versions 2.5.0 through 2.8.6 a medium severity vulnerability CVE-2026-82325 was detected. This vulnerability allows local authenticated users to cause a system crash. To address this issue, users should upgrade OpenVPN to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-82325.

In FreeIPA (unspecified versions) a medium severity vulnerability CVE-2026-11873 was detected. This vulnerability allows unauthenticated attackers to cause resource exhaustion through log amplification and expose internal stack traces. To address this issue, users should upgrade FreeIPA to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11873.

In the keycloak-services component for Keycloak in unpatched versions a medium severity vulnerability CVE-2026-79652 was detected. This vulnerability allows an authenticated attacker to bypass user consent requirements and gain unauthorized access. To address this issue, users should upgrade Keycloak to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-79652.

In Keycloak in affected versions a medium severity vulnerability CVE-2025-68833 was detected. This vulnerability allows an attacker unauthorized access to resources. To address this issue, users should upgrade Keycloak to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68833.