[jira] [Created] (YUNIKORN-3267) fix web site dependencies for CVEs

["Wilfred Spiegelenburg (Jira)" <ji...@apache.org>]

Wilfred Spiegelenburg created YUNIKORN-3267:
-----------------------------------------------

             Summary: fix web site dependencies for CVEs
                 Key: YUNIKORN-3267
                 URL: https://issues.apache.org/jira/browse/YUNIKORN-3267
             Project: Apache YuniKorn
          Issue Type: Task
          Components: website
            Reporter: Wilfred Spiegelenburg
            Assignee: Wilfred Spiegelenburg


  null: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
  CVE-2025-62718: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
  CVE-2026-40175: Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
  null: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
  CVE-2026-2950: lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
  CVE-2026-4800: lodash vulnerable to Code Injection via `_.template` imports key names
  CVE-2026-4867: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
  CVE-2026-34043: Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
  CVE-2026-33895: Forge has signature forgery in Ed25519 due to missing S > L check
  CVE-2026-33891: Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
  CVE-2026-33896: Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
  CVE-2026-33894: Forge has signature forgery in RSA-PKCS due to ASN.1 extra field  
  CVE-2026-33672: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
  CVE-2026-33671: Picomatch has a ReDoS vulnerability via extglob quantifiers
  CVE-2026-1526: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
  CVE-2026-2229: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
  CVE-2026-1527: Undici has CRLF Injection in undici via `upgrade` option
  CVE-2026-2581: Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
  CVE-2026-1525: Undici has an HTTP Request/Response Smuggling issue
  CVE-2026-1528: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
  CVE-2026-29074: SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
  null: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
  CVE-2026-27904: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
  CVE-2026-27903: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
  CVE-2026-26996: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
  CVE-2025-69873: ajv has ReDoS when using `$data` option
  CVE-2025-69873: ajv has ReDoS when using `$data` option
  CVE-2026-25639: Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
  CVE-2026-2391: qs's arrayLimit bypass in comma parsing allows denial of service
  CVE-2025-68157: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@yunikorn.apache.org
For additional commands, e-mail: dev-help@yunikorn.apache.org