RHSA-2026:68747
Vulnerability from csaf_redhat - Published: 2026-09-17 20:05 - Updated: 2026-09-21 17:07Summary
Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image
Severity
Important
Notes
Topic: A new satellite/iop-remediations-rhel9 container image is now generally available in the Red Hat container registry.
Details: Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the designated temporary directory. This could lead to unauthorized file creation at attacker-controlled locations with the privileges of the running process.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12143
Threats
Impact
Important
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12143
Threats
Impact
Important
A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a loopback address. This vulnerability can lead to Server-Side Request Forgery (SSRF) and bypass host-based security policies.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12143
Threats
Impact
Important
A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names (IDN) to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an application might validate a URI against a security policy using one hostname, but then resolve to a different, potentially malicious, hostname. This discrepancy could allow an attacker to bypass security policies and access unauthorized resources.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12143
Threats
Impact
Important
A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a different, valid IPv6 destination, such as a local or private IPv6 target. An application normalizing untrusted URLs before outbound requests, redirects, or proxy routing could be redirected, resulting in a server-side request forgery (SSRF) and address-policy bypass.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12143
Threats
Impact
Important
A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers (URIs) in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An attacker can exploit this by crafting a malicious URI, causing the parser to misinterpret the host, which can lead to serious security risks. These risks include unauthorized redirection to external websites, server-side request forgery (SSRF) where the application makes unintended requests to internal or external resources, and bypassing security policies.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12143
Threats
Impact
Important
A flaw was found in qs. The `qs.stringify` function, responsible for serializing objects, does not properly validate the `isBuffer` property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then serialized by `qs.stringify`, triggers a `TypeError`. This vulnerability can lead to a Denial of Service (DoS), causing affected applications to return a 500 error or, in certain scenarios, terminate the application process.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12143
Threats
Impact
Important
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker's host as legitimate.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12143
Threats
Impact
Important
A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a denial of service (DoS) for applications that process untrusted YAML input.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12143
Threats
Impact
Moderate
A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12143
Threats
Impact
Important
References
91 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new satellite/iop-remediations-rhel9 container image is now generally available in the Red Hat container registry.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services. ",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:68747",
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-12143",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44705",
"url": "https://access.redhat.com/security/cve/CVE-2026-44705"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59869",
"url": "https://access.redhat.com/security/cve/CVE-2026-59869"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-75899",
"url": "https://access.redhat.com/security/cve/CVE-2026-75899"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-75931",
"url": "https://access.redhat.com/security/cve/CVE-2026-75931"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-75975",
"url": "https://access.redhat.com/security/cve/CVE-2026-75975"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-76172",
"url": "https://access.redhat.com/security/cve/CVE-2026-76172"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-82417",
"url": "https://access.redhat.com/security/cve/CVE-2026-82417"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84292",
"url": "https://access.redhat.com/security/cve/CVE-2026-84292"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84375",
"url": "https://access.redhat.com/security/cve/CVE-2026-84375"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84394",
"url": "https://access.redhat.com/security/cve/CVE-2026-84394"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://catalog.redhat.com/software/containers/search",
"url": "https://catalog.redhat.com/software/containers/search"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68747.json"
}
],
"title": "Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image",
"tracking": {
"current_release_date": "2026-09-21T17:07:31+00:00",
"generator": {
"date": "2026-09-21T17:07:31+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:68747",
"initial_release_date": "2026-09-17T20:05:29+00:00",
"revision_history": [
{
"date": "2026-09-17T20:05:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-17T20:05:31+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-21T17:07:31+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.19",
"product": {
"name": "Red Hat Satellite 6.19",
"product_id": "Red Hat Satellite 6.19",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.19::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64",
"product": {
"name": "registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64",
"product_id": "registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/iop-remediations-rhel9@sha256%3Ad1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-remediations-rhel9\u0026tag=1789615593"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64 as a component of Red Hat Satellite 6.19",
"product_id": "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
},
"product_reference": "registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64",
"relates_to_product_reference": "Red Hat Satellite 6.19"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-12143",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-06-12T19:00:57.360953+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488480"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (\") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "form-data: form-data: Form field override via CRLF injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important impact flaw in the form-data library: a remote attacker can inject arbitrary headers or additional multipart parts via CRLF injection in field names or filenames, potentially overriding sensitive form fields and affecting data integrity.\n\nFor RHOAI and RHEL AI, severity is Moderate because affected versions appear only as a transitive npm dependency in RHOAI (dashboard, mod-arch plugins, MLflow UI) and RHEL AI 3.4 bootc images, and those products use fixed field names for uploads rather than passing untrusted user input as multipart field names or filenames. The documented exploit path is therefore not reachable in default deployments. Practical impact is limited to non-default or custom integrations that forward multipart requests using attacker-controlled field names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "RHBZ#2488480",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488480"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://cwe.mitre.org/data/definitions/93.html",
"url": "https://cwe.mitre.org/data/definitions/93.html"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435",
"url": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229",
"url": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045",
"url": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx",
"url": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx"
},
{
"category": "external",
"summary": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data",
"url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/form-data",
"url": "https://www.npmjs.com/package/form-data"
}
],
"release_date": "2026-06-12T18:01:30.362000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:05:29+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
},
{
"category": "workaround",
"details": "Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, \") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "form-data: form-data: Form field override via CRLF injection"
},
{
"cve": "CVE-2026-44705",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-06-11T17:01:27.295887+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487946"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the designated temporary directory. This could lead to unauthorized file creation at attacker-controlled locations with the privileges of the running process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tmp: path Traversal via unsanitized prefix/postfix enables directory escape",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Applications that pass user-controlled data to the file or directory creation functions without input sanitization are vulnerable to this issue. This flaw allows files to be created in arbitrary locations with the privileges of the running process. Due to this reason, this vulnerability has been rated with an Important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44705"
},
{
"category": "external",
"summary": "RHBZ#2487946",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487946"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44705"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44705",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44705"
},
{
"category": "external",
"summary": "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65",
"url": "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"
}
],
"release_date": "2026-06-11T15:42:46.565000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:05:29+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, validate and sanitize any user-controlled data before it is passed to the prefix, postfix or dir options of the file or directory creation functions, specifically rejecting or stripping input containing path traversal sequences.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tmp: path Traversal via unsanitized prefix/postfix enables directory escape"
},
{
"cve": "CVE-2026-59869",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-07-08T16:01:38.408322+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498122"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59869"
},
{
"category": "external",
"summary": "RHBZ#2498122",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
"url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
"url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
}
],
"release_date": "2026-07-08T15:15:54.675000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:05:29+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
},
{
"category": "workaround",
"details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
},
{
"cve": "CVE-2026-75899",
"cwe": {
"id": "CWE-140",
"name": "Improper Neutralization of Delimiters"
},
"discovery_date": "2026-08-24T09:51:05.559475+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521778"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a loopback address. This vulnerability can lead to Server-Side Request Forgery (SSRF) and bypass host-based security policies.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in the `fast-uri` library, used by applications for URI parsing, allows for Server-Side Request Forgery (SSRF) and host-policy bypass. By crafting a doubly percent-encoded hostname in an untrusted HTTP-family URI, an attacker could redirect internal application requests to arbitrary network destinations, potentially bypassing security controls and accessing internal services. This risk is present in Red Hat products that process untrusted URIs using affected versions of `fast-uri`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75899"
},
{
"category": "external",
"summary": "RHBZ#2521778",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521778"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75899"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75899",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75899"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf"
}
],
"release_date": "2026-08-24T09:40:19.801000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:05:29+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding"
},
{
"cve": "CVE-2026-75931",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-08-24T09:51:02.191062+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521777"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names (IDN) to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an application might validate a URI against a security policy using one hostname, but then resolve to a different, potentially malicious, hostname. This discrepancy could allow an attacker to bypass security policies and access unauthorized resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Host confusion via skipped IDN canonicalization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75931"
},
{
"category": "external",
"summary": "RHBZ#2521777",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521777"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75931",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75931"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75931",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75931"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8"
}
],
"release_date": "2026-08-24T09:30:04.212000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:05:29+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Host confusion via skipped IDN canonicalization"
},
{
"cve": "CVE-2026-75975",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-08-24T10:11:05.356309+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a different, valid IPv6 destination, such as a local or private IPv6 target. An application normalizing untrusted URLs before outbound requests, redirects, or proxy routing could be redirected, resulting in a server-side request forgery (SSRF) and address-policy bypass.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75975"
},
{
"category": "external",
"summary": "RHBZ#2521779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75975",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75975"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75975",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75975"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc"
}
],
"release_date": "2026-08-24T09:58:07.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:05:29+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization"
},
{
"cve": "CVE-2026-76172",
"cwe": {
"id": "CWE-76",
"name": "Improper Neutralization of Equivalent Special Elements"
},
"discovery_date": "2026-08-24T10:31:12.887477+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521798"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers (URIs) in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An attacker can exploit this by crafting a malicious URI, causing the parser to misinterpret the host, which can lead to serious security risks. These risks include unauthorized redirection to external websites, server-side request forgery (SSRF) where the application makes unintended requests to internal or external resources, and bypassing security policies.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76172"
},
{
"category": "external",
"summary": "RHBZ#2521798",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521798"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76172",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76172"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76172",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76172"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp"
}
],
"release_date": "2026-08-24T10:07:56.440000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:05:29+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects"
},
{
"cve": "CVE-2026-82417",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-08-30T00:00:50.379994+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2525936"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in qs. The `qs.stringify` function, responsible for serializing objects, does not properly validate the `isBuffer` property of an object\u0027s constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then serialized by `qs.stringify`, triggers a `TypeError`. This vulnerability can lead to a Denial of Service (DoS), causing affected applications to return a 500 error or, in certain scenarios, terminate the application process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qs: qs: Denial of Service via improper validation in stringify function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A denial of service vulnerability was found in the qs package for Node.js. The stringify function does not verify that constructor.isBuffer is callable before invoking it. An attacker who can influence object shape, for example through query parameters parsed with allowPrototypes: true as Express 4 does by default, can cause qs.stringify to throw a TypeError when that data is re-serialized. In typical Node.js HTTP frameworks the error is caught per request and returns HTTP 500. In code paths without an error boundary, such as async handlers or background jobs, the process may exit.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-82417"
},
{
"category": "external",
"summary": "RHBZ#2525936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525936"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-82417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-82417"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82417",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82417"
},
{
"category": "external",
"summary": "https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6",
"url": "https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"
},
{
"category": "external",
"summary": "https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g",
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"
}
],
"release_date": "2026-08-29T23:51:27.634000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:05:29+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
},
{
"category": "workaround",
"details": "If an immediate upgrade to qs 6.16.0 is not feasible, avoid re-serializing attacker-influenced parsed query or body objects with qs.stringify. Where qs.parse is used directly, set allowPrototypes: false unless prototype keys are required. For Express applications, review whether the default query parser configuration is necessary. Wrapping qs.stringify calls in try/catch can limit impact to individual requests.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qs: qs: Denial of Service via improper validation in stringify function"
},
{
"cve": "CVE-2026-84292",
"cwe": {
"id": "CWE-140",
"name": "Improper Neutralization of Delimiters"
},
"discovery_date": "2026-09-02T20:21:15.599288+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2527747"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker\u0027s host as legitimate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84292"
},
{
"category": "external",
"summary": "RHBZ#2527747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84292"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"
}
],
"release_date": "2026-09-02T20:09:51.415000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:05:29+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization"
},
{
"cve": "CVE-2026-84375",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-09-01T21:51:30.205823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2527118"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a denial of service (DoS) for applications that process untrusted YAML input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in js-yaml, affecting applications that process untrusted YAML input. The flaw allows an attacker to craft a small YAML document that, when parsed, can lead to prolonged CPU consumption due to inefficient merge key processing, potentially exhausting system resources. This is particularly relevant where applications handle external YAML data and have merge processing enabled by default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84375"
},
{
"category": "external",
"summary": "RHBZ#2527118",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527118"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84375"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84375",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84375"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/pull/797",
"url": "https://github.com/nodeca/js-yaml/pull/797"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2"
},
{
"category": "external",
"summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"
}
],
"release_date": "2026-09-01T21:43:13.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:05:29+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing"
},
{
"cve": "CVE-2026-84394",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-09-02T20:31:21.036047+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2527756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Moderate because successful exploitation requires a specific configuration where fast-uri handles security checks but a different client resolves the URL, enabling security policy bypasses without direct code execution. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3 (fixed in 2.4.6, 3.1.7, and 4.1.4).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84394"
},
{
"category": "external",
"summary": "RHBZ#2527756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84394"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g"
}
],
"release_date": "2026-09-02T20:25:35.399000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:05:29+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-remediations-rhel9@sha256:d1165533561121ef2a8d4df99bc2830fa22c19b72366a736267244cc461ce0d4_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…