CVE-2026-34986: Go-Jose Vulnerability in NetApp Products

High [CVE-2026-34986] Go-Jose Vulnerability in NetApp Products

NTAP-20260617-0020Source published Jun 17, 2026Source updated Aug 19, 2026

Multiple NetApp products incorporate Go-Jose. Go-Jose versions 3.0.0 prior to 3.0.5 and 4.0.0 prior to 4.1.4 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Trident Protect. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.

Affected products in this advisory

• Trident Protect

Source-reported affected versions

• 3.0.0
• 3.0.5
• 4.0.0
• 4.1.4

Source-reported fixed versions

• Trident Protect: 26.06

Mitigation guidance

• Update affected NetApp products to a fixed release: Trident Protect: 26.06.
• Trident Protect: Fixed in 26.06.

High [CVE-2026-34986] Denial of Service via crafted JSON Web Encryption (JWE) object

CVE-2026-34986Source published Apr 6, 2026

Denial of Service via crafted JSON Web Encryption (JWE) object. Red Hat rates this important (CVSS 7.5). Weakness: CWE-131. Affected package(s): odf4/mcg-core-rhel9:1776403991, openshift-service-mesh/pilot-rhel8:1777319850, openshift-service-mesh/istio-cni-rhel8:1777374598, odf4/odf-cloudnative-pg-rhel9-operator:1776406131, multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1778867753, multicluster-engine/assisted-installer-agent-rhel9:1776351169. Resolved in Red Hat advisory RHSA-2026:25194 — update the affected packages (`sudo dnf update`).

Affected products in this advisory

• Cryostat 4 on RHEL 9
• Red Hat Enterprise Linux AppStream EUS (v. 10.0)
• Red Hat Enterprise Linux AppStream (v. 10)
• Red Hat Enterprise Linux AppStream (v. 8)

92 more entries in the full advisory.

Source-reported affected versions

• odf4/mcg-core-rhel9:1776403991
• openshift-service-mesh/pilot-rhel8:1777319850
• openshift-service-mesh/istio-cni-rhel8:1777374598
• odf4/odf-cloudnative-pg-rhel9-operator:1776406131

8 more entries in the full advisory.

Source-reported fixed versions

• RHSA-2026:25194

Mitigation guidance

• Update the affected package(s) to the fixed version shipped in RHSA-2026:25194 (`sudo dnf update` / `yum update`).

Critical [CVE-2026-27141 +23] Third-Party Package Updates in Splunk Enterprise - September/October 2026

SVD-2026-1003Source published Oct 7, 2026

This bulletin covers 24 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Splunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 or higher. Affected products named by the advisory: Splunk Enterprise 10.4; Splunk Enterprise 10.2; Splunk Enterprise 10.0; Splunk Enterprise 9.4.

Affected products in this advisory

• Splunk Enterprise 10.4
• Splunk Enterprise 10.2
• Splunk Enterprise 10.0
• Splunk Enterprise 9.4

Source-reported affected versions

• Splunk Enterprise 10.4.0 to 10.4.2
• Splunk Enterprise 10.2.0 to 10.2.6
• Splunk Enterprise 10.0.0 to 10.0.9
• Splunk Enterprise 9.4.0 to 9.4.14

Source-reported fixed versions

• Splunk Enterprise 10.4.3
• Splunk Enterprise 10.2.7
• Splunk Enterprise 10.0.10
• Splunk Enterprise 9.4.15

Mitigation guidance

• Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 or higher.

Critical [CVE-2024-35255 +32] Third-Party Package Updates in Splunk Enterprise - August 2026

SVD-2026-0802Source published Aug 19, 2026

This bulletin covers 33 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, and higher. Affected products named by the advisory: Splunk Enterprise 10.4; Splunk Enterprise 10.2; Splunk Enterprise 10.0; Splunk Enterprise 9.4.

Affected products in this advisory

• Splunk Enterprise 10.4
• Splunk Enterprise 10.2
• Splunk Enterprise 10.0
• Splunk Enterprise 9.4

Source-reported affected versions

• Splunk Enterprise 10.4.0 to 10.4.1
• Splunk Enterprise 10.2.0 to 10.2.5
• Splunk Enterprise 10.0.0 to 10.0.8
• Splunk Enterprise 9.4.0 to 9.4.13

Source-reported fixed versions

• Splunk Enterprise 10.4.2
• Splunk Enterprise 10.2.6
• Splunk Enterprise 10.0.9
• Splunk Enterprise 9.4.14

Mitigation guidance

• Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, or higher.