CVE-2024-35255Medium· 5.5▾ SunlitA flaw was found in Microsoft's Azure Identity Libraries and the Microsoft Authentication Library (MSAL). The flaw arises from a race condition—a scenario where the timing of events leads to unexpected behavior—during concurrent operations…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.8%
0.8% → 0.8%
Last analysed / modified upstream
A flaw was found in Microsoft's Azure Identity Libraries and the Microsoft Authentication Library (MSAL). The flaw arises from a race condition—a scenario where the timing of events leads to unexpected behavior—during concurrent operations on shared resources. This can result in privilege escalation, allowing attackers to gain unauthorized access to sensitive information. The vulnerability affects multiple versions of these libraries across various programming languages, including Java, .NET, Node.js, Python, JavaScript, C++, and Go. Microsoft has addressed this issue by releasing updated versions of the affected libraries. Users are strongly advised to upgrade to these patched versions to mitigate potential security risks.
azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity — rated Moderate by Red Hat. Released 2024-07-01, updated 2026-10-09.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHBA-2024:7523 Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). https://access.redhat.com/errata/RHSA-2024:7052 Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.
Automatic, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting.Manual, then you must manually approve the upgrade to… https://access.redhat.com/errata/RHSA-2025:0536Affected packages:
azure-identity < 1.16.1@azure/identity < 4.2.1com.azure:azure-identity < 1.12.2@azure/msal-node >= 2.7.0, < 2.9.2Microsoft.Identity.Client >= 4.49.1, < 4.60.4github.com/Azure/azure-sdk-for-go/sdk/azidentity < 1.6.0-beta.4.0.20240610221955-50774cd97099com.microsoft.azure:msal4j >= 1.14.4-beta, < 1.15.1Azure.Identity < 1.11.4Microsoft.Identity.Client >= 4.61.0, < 4.61.3Patched in:
azure-identity 1.16.1@azure/identity 4.2.1com.azure:azure-identity 1.12.2@azure/msal-node 2.9.2Microsoft.Identity.Client 4.60.4github.com/Azure/azure-sdk-for-go/sdk/azidentity 1.6.0-beta.4.0.20240610221955-50774cd97099com.microsoft.azure:msal4j 1.15.1Azure.Identity 1.11.4Microsoft.Identity.Client 4.61.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-114138High· 7.5djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)
CVE-2026-96644High· 7.1pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser (CVE-2026-96644)
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)