RHSA-2026:51197

Vulnerability from csaf_redhat - Published: 2026-08-06 17:22 - Updated: 2026-09-24 17:57
Summary
Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
Severity
Important
Notes
Topic: A new satellite/iop-vulnerability-frontend-rhel9 container image is now available as a technical preview in the Red Hat container registry.
Details: Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-13149

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333 - Inefficient Regular Expression Complexity
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-13676

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Fixed 1 product, the same list as for CVE-2026-13149
Threats
Impact Important
CVE-2026-44990

A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Fixed 1 product, the same list as for CVE-2026-13149
Threats
Impact Important
CVE-2026-45822

A flaw was found in the `decode-uri-component` library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 1 product, the same list as for CVE-2026-13149
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:51197 self
https://access.redhat.com/documentation/en-us/red… external
https://access.redhat.com/security/cve/CVE-2026-13149 external
https://access.redhat.com/security/cve/CVE-2026-13676 external
https://access.redhat.com/security/cve/CVE-2026-44990 external
https://access.redhat.com/security/cve/CVE-2026-45822 external
https://access.redhat.com/security/updates/classi… external
https://catalog.redhat.com/software/containers/search external
https://docs.redhat.com/en/documentation/red_hat_… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-13149 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494813 external
https://www.cve.org/CVERecord?id=CVE-2026-13149 external
https://nvd.nist.gov/vuln/detail/CVE-2026-13149 external
https://github.com/juliangruber/brace-expansion/c… external
https://www.npmjs.com/package/brace-expansion external
https://access.redhat.com/security/cve/CVE-2026-13676 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494197 external
https://www.cve.org/CVERecord?id=CVE-2026-13676 external
https://nvd.nist.gov/vuln/detail/CVE-2026-13676 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-44990 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488565 external
https://www.cve.org/CVERecord?id=CVE-2026-44990 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44990 external
https://github.com/apostrophecms/apostrophe/secur… external
https://access.redhat.com/security/cve/CVE-2026-45822 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494807 external
https://www.cve.org/CVERecord?id=CVE-2026-45822 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45822 external
https://github.com/SamVerschueren/decode-uri-comp… external
https://github.com/SamVerschueren/decode-uri-comp… external
https://www.npmjs.com/package/decode-uri-component external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new satellite/iop-vulnerability-frontend-rhel9 container image is now available as a technical preview in the Red Hat container registry.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying  predefined rules to a small set of local data, such as installed packages,  running services, and configuration settings.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:51197",
        "url": "https://access.redhat.com/errata/RHSA-2026:51197"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44990",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44990"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45822",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45822"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
        "url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51197.json"
      }
    ],
    "title": "Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image",
    "tracking": {
      "current_release_date": "2026-09-24T17:57:38+00:00",
      "generator": {
        "date": "2026-09-24T17:57:38+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:51197",
      "initial_release_date": "2026-08-06T17:22:37+00:00",
      "revision_history": [
        {
          "date": "2026-08-06T17:22:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-24T17:57:38+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.19",
                "product": {
                  "name": "Red Hat Satellite 6.19",
                  "product_id": "Red Hat Satellite 6.19",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.19::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64",
                "product": {
                  "name": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64",
                  "product_id": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/iop-vulnerability-frontend-rhel9@sha256%3A260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9\u0026tag=1785937325"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64 as a component of Red Hat Satellite 6.19",
          "product_id": "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
        },
        "product_reference": "registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64",
        "relates_to_product_reference": "Red Hat Satellite 6.19"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T17:22:37+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51197"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-13676",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-29T14:01:55.592330+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494197"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494197",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
        }
      ],
      "release_date": "2026-06-29T13:22:44.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T17:22:37+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51197"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
    },
    {
      "cve": "CVE-2026-44990",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-06-12T21:02:24.911971+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488565"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. The `sanitize-html` library, used in Red Hat products, is susceptible to a stored Cross-Site Scripting (XSS) bypass. Malicious content within a disallowed `xmp` element can be rendered as live HTML or JavaScript due to a sanitizer bypass in the default configuration. This can lead to arbitrary code execution or information disclosure when affected content is viewed.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44990"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488565",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488565"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44990",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44990"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990"
        },
        {
          "category": "external",
          "summary": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643",
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643"
        }
      ],
      "release_date": "2026-06-12T20:39:47.065000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T17:22:37+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51197"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass"
    },
    {
      "cve": "CVE-2026-45822",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-30T09:01:06.468966+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494807"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `decode-uri-component` library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "decode-uri-component: decode-uri-component: Denial of Service via crafted input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial of service flaw was found in the decode-uri-component npm package. The decode() function exhibits super-linear time complexity when processing input containing many percent-encoded sequences, allowing an attacker to cause significant CPU consumption and event-loop blocking. In Red Hat products where this package is bundled (OpenShift Console, Quay, Pipelines, RHOAI, and others), exploitation requires that attacker-controlled input containing crafted percent-encoded strings reaches the decode() function without prior length validation. Red Hat rates this as Moderate severity since the impact is limited to availability with no confidentiality or integrity impact, consistent with the CNA\u0027s CVSS 4.0 assessment of 6.6 Medium.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45822"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494807",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494807"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45822",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45822"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45822",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45822"
        },
        {
          "category": "external",
          "summary": "https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js",
          "url": "https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js"
        },
        {
          "category": "external",
          "summary": "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005",
          "url": "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/decode-uri-component",
          "url": "https://www.npmjs.com/package/decode-uri-component"
        }
      ],
      "release_date": "2026-06-30T08:05:36.399000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T17:22:37+00:00",
          "details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51197"
        },
        {
          "category": "workaround",
          "details": "Validate and limit the length of any user-controlled input before passing it to decode-uri-component\u0027s decode() function. Inputs containing more than approximately 200 percent-encoded tokens (e.g. \u0027%ab\u0027 sequences) can trigger noticeable delays. Reject or truncate URI components exceeding a reasonable length threshold before decoding. A fix exists in the upstream repository (commit fa479daf) but has not yet been included in an npm release.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:260835b97f39228acf263df37df4808e30844fdf02078f6c1e204a75e826a49f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "decode-uri-component: decode-uri-component: Denial of Service via crafted input"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.