Red Hat Red Hat 3scale API Management Platform 2
10 CVEs affecting Red Hat Red Hat 3scale API Management Platform 2. Latest disclosed: 2026-09-17. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49794 | Critical | 9.1 | 2025-06-16 | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the… |
CVE-2024-12125 | High | 7.5 | 2025-11-06 | A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly con… |
CVE-2024-10295 | High | 7.5 | 2024-10-24 | A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed bas… |
CVE-2023-0456 | High | 7.4 | 2023-09-27 | A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a… |
CVE-2026-92925 | High | 7.1 | 2026-09-17 | A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-ca… |
CVE-2024-0560 | Medium | 6.3 | 2024-02-28 | A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Toke… |
CVE-2023-4910 | Medium | 5.5 | 2023-11-06 | A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is r… |
CVE-2024-11831 | Medium | 5.4 | 2025-02-10 | A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such… |
CVE-2024-9671 | Medium | 5.3 | 2024-10-09 | A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the… |
CVE-2023-5349 | Medium | 5.3 | 2023-10-30 | A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion. |