Weekly CVE Digest — March 22, 2026
March 22, 2026 · PackageFix · 7 CVEs this week across npm, PyPI, Ruby, Go, Rust, Java
Every week PackageFix monitors the OSV database and CISA KEV catalog for new entries. This week had 7 worth paying attention to — two of them are CRITICAL and one is actively being exploited in production systems right now. Here's what to patch first.
This Week's CVEs
CVE-2024-29041 — express
Affected: 4.17.1 · Fix: 4.19.2
Open redirect via response.redirect() with unsanitized input. If you accept user-controlled redirect targets, upgrade immediately.
CVE-2023-44487 — grpc-go / golang.org/x/net / Netty / hyper
Affected: multiple · Fix: see fix guides
HTTP/2 rapid reset attack enabling denial of service. Affects any server implementing HTTP/2. Multiple ecosystems affected simultaneously — check all your Go, Java, and Rust dependencies.
CVE-2024-27351 — Django
Affected: < 4.2.13 / < 5.0.3 · Fix: 4.2.13 / 5.0.3
ReDoS in strip_tags() HTML sanitizer. If you use django.utils.html.strip_tags() on untrusted input, this can cause server hang under load.
CVE-2022-1471 — SnakeYAML
Affected: < 2.0 · Fix: 2.0+
Remote code execution via unsafe YAML deserialization. Any application using new Yaml().load() with untrusted input is fully compromised. Appears on CISA KEV — actively exploited.
CVE-2024-21508 — mysql2
Affected: < 3.9.7 · Fix: 3.9.7
Remote code execution via SQL injection in prepared statement handling. If you use mysql2 with user-controlled input in preparedStatement, upgrade immediately.
CVE-2024-35176 — rexml
Affected: < 3.2.6 · Fix: 3.2.6
Denial of service via XML entity expansion. Affects any Ruby application parsing untrusted XML with rexml. Bundled with Ruby stdlib.
CVE-2024-1135 — gunicorn
Affected: < 22.0.0 · Fix: 22.0.0
HTTP request smuggling via invalid Transfer-Encoding header. Any gunicorn deployment behind a reverse proxy is potentially affected.
Paste your manifest — get back a fixed version with all CVEs patched in seconds.
Open PackageFix →No signup · No CLI · No GitHub · Runs 100% in your browser