CVE-2026-55685Medium· 6.5▾ SunlitA flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service (DoS). This can put a heavy load on the server, significantly slowing down response times and…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.6%
6.5 → —
medium → high
— → 6.5
high → medium
6.5 → —
medium → high
— → 6.5
high → medium
6.5 → —
medium → high
— → 6.5
high → medium
0.6% → 0.7%
Last analysed / modified upstream
A flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service (DoS). This can put a heavy load on the server, significantly slowing down response times and impacting the availability of the application.
react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests — rated Moderate by Red Hat. Released 2026-07-27, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
For Red Hat OpenShift AI 2.25.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:65126 For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:60520 For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734
Workarounds / mitigations:
Affected packages:
react-router >= 7.0.0, < 7.18.0Patched in:
react-router 7.18.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59885High· 7.5pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885)
CVE-2026-59884Medium· 5.9python-pyasn1: pyasn1: Denial of Service via crafted BER input (CVE-2026-59884)
CVE-2026-13311Medium· 6.5shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing (CVE-2026-13311)
CVE-2026-12243High· 7.5Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-59200High· 7.5Pillow: Pillow: Denial of service via crafted PDF stream (CVE-2026-59200)
CVE-2026-49476Medium· 5.9python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string (CVE-2026-49476)