Status: UPDATED | Advisory ID: CVE-2026-41242
| CVE | CVE-2026-41242 |
| CVSS Score / Version | |
| Updated | 2026-11-03 |
| CVSS Vector | |
| CVSS Prose | |
| Affected products | |
| Classified as |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Red Hat | Red Hat OpenShift AI 3.3 | ||
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | ||
| Red Hat | Red Hat OpenShift AI (RHOAI) | ||
| Red Hat | Red Hat OpenShift AI 2.25 | ||
| Red Hat | Red Hat build of Apicurio Registry 3 | ||
| Red Hat | Red Hat OpenShift Container Platform 4 | ||
| Red Hat | Red Hat Openshift Data Foundation 4 | ||
| Red Hat | Self-service automation portal 2 | ||
| Red Hat | Red Hat Developer Hub 1.8 | ||
| Red Hat | Red Hat Developer Hub 1.9 | ||
| Red Hat | OpenShift Pipelines | ||
| Red Hat | Red Hat Developer Hub | ||
| Red Hat | Red Hat OpenShift Dev Spaces 3.30 | ||
| Red Hat | Red Hat Build of Podman Desktop | ||
| Red Hat | Red Hat Ceph Storage 9 | ||
| Red Hat | Cryostat 4 | ||
| protobufjs_project | protobufjs | ||
| protobufjs | protobuf.js |
| Subsystems | OT Supporting Infrastructure |
| Sectors | Multiple |
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue. (NVD)
Monitor Red Hat, protobufjs_project, and protobufjs's web pages for any future patch releases. See vendor advisory link below.