Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-33894
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-27 Mar, 2026 | 20:45
Updated At-27 Jul, 2026 | 12:05
Rejected At-
▼CVE Numbering Authority (CNA)
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing “garbage” bytes within the ASN structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN structure, rather than outside of it. Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries. Version 1.4.0 patches the issue.

Affected Products
Vendor
digitalbazaar
Product
forge
Versions
Affected
  • < 1.4.0
Problem Types
TypeCWE IDDescription
CWECWE-347CWE-347: Improper Verification of Cryptographic Signature
CWECWE-20CWE-20: Improper Input Validation
Type: CWE
CWE ID: CWE-347
Description: CWE-347: Improper Verification of Cryptographic Signature
Type: CWE
CWE ID: CWE-20
Description: CWE-20: Improper Input Validation
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp
x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp
x_refsource_MISC
https://datatracker.ietf.org/doc/html/rfc2313#section-8
x_refsource_MISC
https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE
x_refsource_MISC
https://www.rfc-editor.org/rfc/rfc8017.html
x_refsource_MISC
Hyperlink: https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp
Resource:
x_refsource_MISC
Hyperlink: https://datatracker.ietf.org/doc/html/rfc2313#section-8
Resource:
x_refsource_MISC
Hyperlink: https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE
Resource:
x_refsource_MISC
Hyperlink: https://www.rfc-editor.org/rfc/rfc8017.html
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
2. node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification

A flaw was found in Forge (also called `node-forge`), a JavaScript implementation of Transport Layer Security. A remote attacker could exploit weaknesses in the RSASSA PKCS#1 v1.5 signature verification process. By crafting malicious signatures that include extra data within the ASN structure and do not meet padding requirements, an attacker can bypass signature validation. This allows for the creation of forged signatures that appear legitimate, potentially compromising the integrity and authenticity of communications.

Affected Products
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Ansible Automation Platform 2.5 for RHEL 8
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
automation-gateway
CPEs
  • cpe:/a:redhat:ansible_automation_platform:2.5::el8
Default Status
affected
Versions
Unaffected
  • From 0:2.5.20260422-3.el8ap before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Ansible Automation Platform 2.5 for RHEL 9
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
automation-gateway
CPEs
  • cpe:/a:redhat:ansible_automation_platform:2.5::el9
Default Status
affected
Versions
Unaffected
  • From 0:2.5.20260422-3.el9ap before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Cluster Observability Operator 1.5.0
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
cluster-observability-operator/logging-console-plugin-pf4-rhel9
CPEs
  • cpe:/a:redhat:cluster_observability_operator:1.5::el9
Default Status
affected
Versions
Unaffected
  • From 1782839279 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Developer Hub 1.8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
rhdh/rhdh-hub-rhel9
CPEs
  • cpe:/a:redhat:rhdh:1.8::el9
Default Status
affected
Versions
Unaffected
  • From 1776784286 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Developer Hub 1.9
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
rhdh/rhdh-hub-rhel9
CPEs
  • cpe:/a:redhat:rhdh:1.9::el9
Default Status
affected
Versions
Unaffected
  • From 1777903262 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Quay 3.1
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
quay/quay-rhel8
CPEs
  • cpe:/a:redhat:quay:3.10::el8
Default Status
affected
Versions
Unaffected
  • From 1779822261 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Quay 3.12
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
quay/quay-rhel8
CPEs
  • cpe:/a:redhat:quay:3.12::el8
Default Status
affected
Versions
Unaffected
  • From 1779811412 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Quay 3.14
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
quay/quay-rhel8
CPEs
  • cpe:/a:redhat:quay:3.14::el8
Default Status
affected
Versions
Unaffected
  • From 1779689392 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Quay 3.15
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
quay/quay-rhel8
CPEs
  • cpe:/a:redhat:quay:3.15::el8
Default Status
affected
Versions
Unaffected
  • From 1780891395 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Quay 3.16
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
quay/quay-rhel9
CPEs
  • cpe:/a:redhat:quay:3.16::el9
Default Status
affected
Versions
Unaffected
  • From 1779204086 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Quay 3.17
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
quay/quay-rhel9
CPEs
  • cpe:/a:redhat:quay:3.17::el9
Default Status
affected
Versions
Unaffected
  • From 1779922205 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Quay 3.9
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
quay/quay-rhel8
CPEs
  • cpe:/a:redhat:quay:3.9::el8
Default Status
affected
Versions
Unaffected
  • From 1779811473 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Cryostat 4
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
io.cryostat-cryostat
CPEs
  • cpe:/a:redhat:cryostat:4
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/elasticsearch6-rhel9
CPEs
  • cpe:/a:redhat:logging:5
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/elasticsearch-operator-bundle
CPEs
  • cpe:/a:redhat:logging:5
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/elasticsearch-proxy-rhel9
CPEs
  • cpe:/a:redhat:logging:5
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/elasticsearch-rhel9-operator
CPEs
  • cpe:/a:redhat:logging:5
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/kibana6-rhel8
CPEs
  • cpe:/a:redhat:logging:5
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/logging-curator5-rhel9
CPEs
  • cpe:/a:redhat:logging:5
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Ansible Automation Platform 2
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
automation-eda-controller
CPEs
  • cpe:/a:redhat:ansible_automation_platform:2
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Ansible Automation Platform 2
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
automation-platform-ui
CPEs
  • cpe:/a:redhat:ansible_automation_platform:2
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Apache Camel - HawtIO 4
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
io.hawt-project
CPEs
  • cpe:/a:redhat:apache_camel_hawtio:4
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat build of Apicurio Registry 2
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
io.apicurio-apicurio-registry
CPEs
  • cpe:/a:redhat:service_registry:2
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Build of Podman Desktop
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
podman-desktop-macos-1-0
CPEs
  • cpe:/a:redhat:podman_desktop:1
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Build of Podman Desktop
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
podman-desktop-windows-1-0
CPEs
  • cpe:/a:redhat:podman_desktop:1
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Data Grid 8
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
org.infinispan-infinispan-console
CPEs
  • cpe:/a:redhat:jboss_data_grid:8
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 10
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
grafana
CPEs
  • cpe:/o:redhat:enterprise_linux:10
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
pcs
CPEs
  • cpe:/o:redhat:enterprise_linux:8
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
grafana
CPEs
  • cpe:/o:redhat:enterprise_linux:9
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
pcs
CPEs
  • cpe:/o:redhat:enterprise_linux:9
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Fuse 7
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
io.apicurio-apicurito
CPEs
  • cpe:/a:redhat:jboss_fuse:7
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Fuse 7
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
io.syndesis-syndesis-parent
CPEs
  • cpe:/a:redhat:jboss_fuse:7
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Process Automation 7
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
org.uberfire-uberfire-parent
CPEs
  • cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Default Status
unaffected
Problem Types
TypeCWE IDDescription
CWECWE-347Improper Verification of Cryptographic Signature
Type: CWE
CWE ID: CWE-347
Description: Improper Verification of Cryptographic Signature
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Metrics Other Info
Red Hat severity rating
value:
Important
namespace:
https://access.redhat.com/security/updates/classification/
Impacts
CAPEC IDDescription
Solutions

RHSA-2026:24761: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9

RHSA-2026:34342: Cluster Observability Operator 1.5.0

RHSA-2026:9742: Red Hat Developer Hub 1.8

RHSA-2026:13826: Red Hat Developer Hub 1.9

RHSA-2026:22629: Red Hat Quay 3.12

RHSA-2026:21017: Red Hat Quay 3.14

RHSA-2026:24853: Red Hat Quay 3.15

RHSA-2026:19375: Red Hat Quay 3.16

RHSA-2026:22465: Red Hat Quay 3.17

RHSA-2026:22840: Red Hat Quay 3.1

RHSA-2026:23361: Red Hat Quay 3.9

Configurations
Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Exploits
Credits
Timeline
EventDate
Reported to Red Hat.2026-03-27 21:02:52
Made public.2026-03-27 20:45:49
Event: Reported to Red Hat.
Date: 2026-03-27 21:02:52
Event: Made public.
Date: 2026-03-27 20:45:49
Replaced By
Rejected Reason
References
HyperlinkResource
https://access.redhat.com/security/cve/CVE-2026-33894
vdb-entry
x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2452464
issue-tracking
x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33894.json
x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:24761
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34342
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9742
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13826
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22629
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21017
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24853
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19375
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22465
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22840
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23361
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/security/cve/CVE-2026-33894
Resource:
vdb-entry
x_refsource_REDHAT
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2452464
Resource:
issue-tracking
x_refsource_REDHAT
Hyperlink: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33894.json
Resource:
x_sadp-csaf-vex
Hyperlink: https://access.redhat.com/errata/RHSA-2026:24761
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:34342
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:9742
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:13826
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:22629
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:21017
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:24853
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:19375
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:22465
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:22840
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:23361
Resource:
vendor-advisory
x_refsource_REDHAT
Details not found