Medium WID-SEC-2026-0770 6 CVEs

Atlassian Jira: Mehrere Schwachstellen

Published Mar 17, 2026 · Updated May 18, 2026 · Revision 3 · de-DE

Vendor: Atlassian Vendor: Red Hat Product: Enterprise Linux Product: Jira Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren und offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen oder einen Denial-of-Service-Zustand herbeizuführen.

Product

Jira ist eine Webanwendung zur Softwareentwicklung.

Vulnerabilities 6

High 8.8

CVE-2026-23950

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesyst…

isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm

Jan 20, 2026
High 8.2

CVE-2026-23745 Public exploit

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root r…

isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm

Jan 16, 2026
High 8.2

CVE-2026-24842

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicio…

isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Alpine Wolfi npm

Jan 28, 2026
Medium 5.3

CVE-2020-28469

Regular Expression Denial of Service (ReDoS)

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

js-jquery nodejs-nodemon glob-parent node-glob-parent Debian Azure Linux npm

Jun 3, 2021
Medium 5.3

CVE-2022-25883

semver vulnerable to Regular Expression Denial of Service

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

nodejs js-jquery nodejs18 nodejs-nodemon Debian Ubuntu Azure Linux npm

Jun 21, 2023
Medium 5.3

CVE-2022-25927 Public exploit

ReDoS Vulnerability in ua-parser-js version

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

ua-parser-js node-ua-parser-js node-ua-parser-js Debian Ubuntu npm

Jan 25, 2023

Revision history

2026-05-18 #3
Neue Updates von Red Hat aufgenommen
2026-03-23 #2
Neue Updates von Red Hat aufgenommen
2026-03-17 #1
Initiale Fassung

References

Jira Atlassian Issue vom 2026-03-17
https://confluence.atlassian.com/security/security-bulletin-march-17-2026-1721271371.html
Red Hat Security Advisory RHSA-2026:5447 vom 2026-03-23
https://access.redhat.com/errata/RHSA-2026:5447
Red Hat Security Advisory RHSA-2026:18480 vom 2026-05-19
https://access.redhat.com/errata/RHSA-2026:18480