CVE-2026-55685Medium· 6.5▾ SunlitA flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service (DoS). This can put a heavy load on the server, significantly slowing down response times and…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.6%
0.6% → 0.7%
Last analysed / modified upstream
6.5 → —
medium → high
— → 6.5
high → medium
6.5 → —
medium → high
— → 6.5
high → medium
6.5 → —
medium → high
— → 6.5
high → medium
A flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service (DoS). This can put a heavy load on the server, significantly slowing down response times and impacting the availability of the application.
react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests — rated Moderate by Red Hat. Released 2026-07-27, updated 2026-09-08.
Affected:
Fixed:
No fix planned:
Not affected:
For Red Hat OpenShift AI 2.25.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:65126 For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:60520
Workarounds / mitigations:
Affected packages:
react-router >= 7.0.0, < 7.18.0Patched in:
react-router 7.18.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59885High· 7.5pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885)
CVE-2026-59200High· 7.5Pillow: Pillow: Denial of service via crafted PDF stream (CVE-2026-59200)
CVE-2026-12243High· 7.5nltk: NLTK: Information disclosure via path traversal vulnerability (CVE-2026-12243)
CVE-2026-59204High· 7.5Pillow: Pillow: Denial of Service via crafted JPEG2000 image (CVE-2026-59204)
CVE-2026-55379High· 7.5python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
CVE-2026-42284High· 7.5GitPython: GitPython: Arbitrary code execution via improper validation of clone options (CVE-2026-42284)