PT-2026-34659 · Red Hat+1 · Red Hat Enterprise Linux 6+8

Published 2026-04-23 · Updated 2026-04-24 · CVE-2025-66286

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebKitGTK (affected versions not specified) WPE WebKit (affected versions not specified)

Description An API design flaw allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. While applications typically use the WebPage::send-request signal handler to approve or reject network requests, certain types of HTTP requests bypass this handler.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-66286

Affected Products

Red Hat Enterprise Linux 6

Red Hat Enterprise Linux 7

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

Qtwebkit-Opensource-Src

Qtwebkit-Source

Webkit2Gtk

Webkitgtk

Wpe Webkit

References · 7

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-66286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66286 · Security Note
• https://ubuntu.com/security/CVE-2025-66286 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-66286 · Security Note
• https://bugs.webkit.org/show_bug.cgi?id=259787 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2424652 · Note
• https://access.redhat.com/security/cve/CVE-2025-66286 · Note