RHSA-2026:76677
Vulnerability from csaf_redhat - Published: 2026-10-06 08:26 - Updated: 2026-11-13 00:11Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
grafana12.4:
* grafana12.4-12.4.12-0.4.hum1 (aarch64, x86_64)
* grafana12.4-12.4.12-0.4.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by submitting specially crafted JSON payloads to cause excessive CPU utilization and hang the application, resulting in a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/text. An attacker can cause a Denial of Service (DoS) by submitting specially crafted input to an application utilizing the Nickname profile. When transforming this input into an undersized destination buffer, an out-of-bounds slice indexing error occurs, causing the application to panic and crash.
7.5 (High)
Affected products
Fixed
3 products, the same list as for
CVE-2024-24786
Threats
Impact
Important
A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a Denial of Service (DoS) condition by crashing the affected process.
5.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2024-24786
Threats
Impact
Moderate
A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service (DoS) condition on the Grafana instance. Exploitation requires an administrator to have configured Git Sync to communicate with the untrusted server.
5.3 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2024-24786
Threats
Impact
Moderate
A flaw was found in kin-openapi's openapi3filter module. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by crashing the application. The issue occurs when processing OpenAPI 3.1 array schemas that lack an items definition, causing the parser to encounter an unhandled null pointer while decoding form-encoded or multipart request bodies and response headers. An attacker can exploit this condition by submitting a crafted request to an affected endpoint, resulting in unexpected service termination.
7.5 (High)
Affected products
Fixed
3 products, the same list as for
CVE-2024-24786
Threats
Impact
Important
A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending requests with unsupported or non-canonical HTTP methods to an existing static path. Because the application encounters an unhandled panic before authentication is evaluated, these requests terminate active connections and can cause excessive log storage consumption.
5.3 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2024-24786
Threats
Impact
Moderate
A flaw was found in kin-openapi. A remote attacker could cause a Denial of Service (DoS) by providing a specially crafted OpenAPI document containing self-referential schema definitions. During parsing, an uninitialized reference causes the application to terminate unexpectedly prior to document validation.
5.3 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2024-24786
Threats
Impact
Moderate
A flaw was found in kin-openapi. This vulnerability allows an attacker to cause a Denial of Service (DoS) by triggering an application crash during response validation. When an OpenAPI specification declares a response header using content rather than a schema, the validation logic attempts to dereference an uninitialized pointer, causing the application to panic and terminate.
7.5 (High)
Affected products
Fixed
3 products, the same list as for
CVE-2024-24786
Threats
Impact
Important
A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending requests containing a large number of query parameters to an affected endpoint. Due to redundant regular expression compilation within the parameter decoding loop, processing these requests leads to excessive CPU and memory consumption, potentially degrading application responsiveness or exhausting server resources.
5.3 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2024-24786
Threats
Impact
Moderate
A flaw was found in kin-openapi. An unauthenticated remote attacker can bypass authentication checks on protected routes by sending requests containing encoded path separators. This issue occurs because the request validation handler inspects the decoded URL path, while certain downstream routers dispatch requests using the raw encoded path. As a result, a request can be mistakenly treated as public and forwarded to a protected handler without required authentication.
7.4 (High)
Affected products
Fixed
3 products, the same list as for
CVE-2024-24786
Threats
Impact
Important
A flaw was found in Axios. This vulnerability allows information disclosure when network traffic intended to bypass a proxy is improperly routed through it. Axios fails to parse Classless Inter-Domain Routing (CIDR) notation in proxy bypass lists as IP address ranges, treating them as plain text hostnames instead. As a result, an adversary with access to the configured proxy server can intercept or inspect sensitive request data and connection metadata intended for internal network services.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2024-24786
Threats
Impact
Moderate
A flaw was found in undici. A malicious remote server can cause a Denial of Service (DoS) by returning an invalid handshake response when a client attempts to establish a WebSocket connection over HTTP/2. The client mishandles the failed connection setup and leaves the underlying network stream open without an error handler. When the remote server subsequently terminates the connection, an unhandled error is raised, causing the application process to crash.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2024-24786
Threats
Impact
Important
References
96 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ngrafana12.4:\n * grafana12.4-12.4.12-0.4.hum1 (aarch64, x86_64)\n * grafana12.4-12.4.12-0.4.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:76677",
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56851",
"url": "https://access.redhat.com/security/cve/CVE-2026-56851"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-61801",
"url": "https://access.redhat.com/security/cve/CVE-2026-61801"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-24786",
"url": "https://access.redhat.com/security/cve/CVE-2024-24786"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-95502",
"url": "https://access.redhat.com/security/cve/CVE-2026-95502"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-101899",
"url": "https://access.redhat.com/security/cve/CVE-2026-101899"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109855",
"url": "https://access.redhat.com/security/cve/CVE-2026-109855"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-100347",
"url": "https://access.redhat.com/security/cve/CVE-2026-100347"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-100348",
"url": "https://access.redhat.com/security/cve/CVE-2026-100348"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-100349",
"url": "https://access.redhat.com/security/cve/CVE-2026-100349"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-100350",
"url": "https://access.redhat.com/security/cve/CVE-2026-100350"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-100351",
"url": "https://access.redhat.com/security/cve/CVE-2026-100351"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-97394",
"url": "https://access.redhat.com/security/cve/CVE-2026-97394"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76677.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-11-13T00:11:48+00:00",
"generator": {
"date": "2026-11-13T00:11:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.6"
}
},
"id": "RHSA-2026:76677",
"initial_release_date": "2026-10-06T08:26:00+00:00",
"revision_history": [
{
"date": "2026-10-06T08:26:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-16T09:18:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-13T00:11:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"product": {
"name": "grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"product_id": "grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.12-0.4.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12.4-0:12.4.12-0.4.hum1@src",
"product": {
"name": "grafana12.4-0:12.4.12-0.4.hum1@src",
"product_id": "grafana12.4-0:12.4.12-0.4.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.12-0.4.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12.4-0:12.4.12-0.4.hum1@x86_64",
"product": {
"name": "grafana12.4-0:12.4.12-0.4.hum1@x86_64",
"product_id": "grafana12.4-0:12.4.12-0.4.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.12-0.4.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12.4-0:12.4.12-0.4.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64"
},
"product_reference": "grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12.4-0:12.4.12-0.4.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src"
},
"product_reference": "grafana12.4-0:12.4.12-0.4.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12.4-0:12.4.12-0.4.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
},
"product_reference": "grafana12.4-0:12.4.12-0.4.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-24786",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition"
},
"discovery_date": "2024-03-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268046"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by submitting specially crafted JSON payloads to cause excessive CPU utilization and hang the application, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact because exploitation is restricted to denial of service via excessive CPU and thread consumption, without compromising data confidentiality or system integrity. Red Hat services and containerized components are only exposed if they process untrusted JSON inputs into Protocol Buffer structures configured with specific parsing behaviors. Under typical deployments, the flaw does not grant privileged access or permit arbitrary code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-24786"
},
{
"category": "external",
"summary": "RHBZ#2268046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268046"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-24786",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24786"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24786",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24786"
},
{
"category": "external",
"summary": "https://go.dev/cl/569356",
"url": "https://go.dev/cl/569356"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/",
"url": "https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-2611",
"url": "https://pkg.go.dev/vuln/GO-2024-2611"
}
],
"release_date": "2024-03-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON"
},
{
"cve": "CVE-2026-56851",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-07T18:01:23.622132+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2547607"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/text. An attacker can cause a Denial of Service (DoS) by submitting specially crafted input to an application utilizing the Nickname profile. When transforming this input into an undersized destination buffer, an out-of-bounds slice indexing error occurs, causing the application to panic and crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity impact because unauthenticated network attackers could remotely crash affected services by causing an unhandled application panic, leading to a denial of service. While many Red Hat services and containerized components bundle Go standard and extended libraries, practical exposure is restricted to programs explicitly utilizing the PRECIS Nickname profile to normalize or validate user-provided strings against small memory buffers. Applications that do not handle user nicknames or those that allocate appropriately sized buffers for text transformation are not susceptible to this crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56851"
},
{
"category": "external",
"summary": "RHBZ#2547607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547607"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56851",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56851"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56851",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56851"
},
{
"category": "external",
"summary": "https://go.dev/cl/793360",
"url": "https://go.dev/cl/793360"
},
{
"category": "external",
"summary": "https://go.dev/issue/80112",
"url": "https://go.dev/issue/80112"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-6629",
"url": "https://pkg.go.dev/vuln/GO-2026-6629"
}
],
"release_date": "2026-10-07T17:46:35.620000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile"
},
{
"cve": "CVE-2026-61801",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-08T16:41:20.397001+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2548048"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a Denial of Service (DoS) condition by crashing the affected process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact because exploitation requires supplying a malicious user or group database file to an affected tool, and the resulting impact is limited to an out-of-memory denial of service without compromising confidentiality, integrity, or elevating privileges. Across Red Hat enterprise environments, container management utilities and orchestration platforms invoke these routines when inspecting filesystem layers or resolving identity information during container execution. While an attacker capable of providing a specially crafted database file could trigger resource exhaustion and terminate the consuming process, the flaw does not facilitate container escapes or host compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-61801"
},
{
"category": "external",
"summary": "RHBZ#2548048",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548048"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-61801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61801"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-61801",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61801"
},
{
"category": "external",
"summary": "https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe",
"url": "https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe"
},
{
"category": "external",
"summary": "https://github.com/moby/sys/pull/221",
"url": "https://github.com/moby/sys/pull/221"
},
{
"category": "external",
"summary": "https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw",
"url": "https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw"
}
],
"release_date": "2026-10-08T16:22:25.558000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files"
},
{
"cve": "CVE-2026-95502",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-13T17:26:33.911607+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550709"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service (DoS) condition on the Grafana instance. Exploitation requires an administrator to have configured Git Sync to communicate with the untrusted server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: grafana: Denial of Service via oversized Git Sync responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Moderate. If an administrator configures Grafana Git Sync against a malicious or compromised Git server, oversized or highly compressed responses can exhaust Grafana memory and cause a denial of service. Confidentiality and integrity are not affected. Exploitation depends on administrator-configured Git Sync to an untrusted server, which limits practical exposure. Upstream affects Grafana 13.0.x before 13.0.11, 13.1.x before 13.1.8, and 13.2.x before 13.2.4; Red Hat streams shipping Grafana 12.x or earlier are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-95502"
},
{
"category": "external",
"summary": "RHBZ#2550709",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550709"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-95502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-95502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-95502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95502"
},
{
"category": "external",
"summary": "https://grafana.com/security/security-advisories/cve-2026-95502",
"url": "https://grafana.com/security/security-advisories/cve-2026-95502"
}
],
"release_date": "2026-10-13T17:05:49.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
},
{
"category": "workaround",
"details": "Do not point Git Sync at untrusted Git servers; use only trusted repositories and credentials. Restrict who can configure Git Sync and limit Grafana management-plane network exposure. Apply process or cgroup memory limits to contain memory-exhaustion impact.",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "grafana: grafana: Denial of Service via oversized Git Sync responses"
},
{
"cve": "CVE-2026-97394",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-10-15T15:45:59.705582+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553575"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in kin-openapi\u0027s openapi3filter module. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by crashing the application. The issue occurs when processing OpenAPI 3.1 array schemas that lack an items definition, causing the parser to encounter an unhandled null pointer while decoding form-encoded or multipart request bodies and response headers. An attacker can exploit this condition by submitting a crafted request to an affected endpoint, resulting in unexpected service termination.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in openapi3filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as having an Important severity rating because an unauthenticated remote attacker can deterministically trigger an application crash, resulting in denial of service. The issue specifically impacts environments where incoming network traffic is validated against OpenAPI 3.1 definitions containing array schemas that omit item specifications during multipart or URL-encoded form handling. Deployments utilizing OpenAPI 3.0 or those strictly handling JSON-formatted request bodies remain unaffected by this defect.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97394"
},
{
"category": "external",
"summary": "RHBZ#2553575",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553575"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97394"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97394",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97394"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/commit/30e292371a89ca6d1f91a9553e0aa518b49f838d",
"url": "https://github.com/getkin/kin-openapi/commit/30e292371a89ca6d1f91a9553e0aa518b49f838d"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/releases/tag/v0.143.0",
"url": "https://github.com/getkin/kin-openapi/releases/tag/v0.143.0"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5",
"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5"
}
],
"release_date": "2026-10-15T15:29:05.238000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in openapi3filter"
},
{
"cve": "CVE-2026-100347",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-10-15T15:51:05.132393+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553580"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending requests with unsupported or non-canonical HTTP methods to an existing static path. Because the application encounters an unhandled panic before authentication is evaluated, these requests terminate active connections and can cause excessive log storage consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Moderate because, while an unauthenticated remote caller can trigger request-handling panics against static endpoints, typical Go HTTP server runtimes recover from per-connection panics without terminating the entire daemon process. Applications using kin-openapi for OpenAPI schema validation may experience connection termination and accelerated log storage growth when handling non-standard request methods or method casing variants. The flaw does not facilitate arbitrary code execution or unauthorized data exposure, and its blast radius is restricted to localized denial of service and transient connection resets.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100347"
},
{
"category": "external",
"summary": "RHBZ#2553580",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553580"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100347"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100347",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100347"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3",
"url": "https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/releases/tag/v0.145.0",
"url": "https://github.com/getkin/kin-openapi/releases/tag/v0.145.0"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj",
"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj"
}
],
"release_date": "2026-10-15T15:35:43.874000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths"
},
{
"cve": "CVE-2026-100348",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-10-15T15:45:31.264018+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553571"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in kin-openapi. A remote attacker could cause a Denial of Service (DoS) by providing a specially crafted OpenAPI document containing self-referential schema definitions. During parsing, an uninitialized reference causes the application to terminate unexpectedly prior to document validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via self-referential schema definitions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate severity rather than Important because it only results in an application crash (denial of service) without leading to memory corruption, privilege escalation, or unauthorized data exposure. Impact is limited to environments where applications parse untrusted, user-supplied OpenAPI specifications using the affected schema loader. Workloads that do not accept external OpenAPI documents or only process trusted schemas are not vulnerable to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100348"
},
{
"category": "external",
"summary": "RHBZ#2553571",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553571"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100348"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100348",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100348"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b",
"url": "https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/releases/tag/v0.145.0",
"url": "https://github.com/getkin/kin-openapi/releases/tag/v0.145.0"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx",
"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx"
}
],
"release_date": "2026-10-15T15:31:19.904000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via self-referential schema definitions"
},
{
"cve": "CVE-2026-100349",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-10-15T16:02:25.651913+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553589"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in kin-openapi. This vulnerability allows an attacker to cause a Denial of Service (DoS) by triggering an application crash during response validation. When an OpenAPI specification declares a response header using content rather than a schema, the validation logic attempts to dereference an uninitialized pointer, causing the application to panic and terminate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil pointer dereference in response validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has classified this vulnerability as an Important severity issue because remote unauthenticated network requests can trigger a complete application denial of service if the service validates responses against OpenAPI definitions containing content-defined headers. This elevated rating reflects the wide blast radius where an unhandled nil pointer exception immediately terminates the running daemon without requiring administrative privileges. While most default Red Hat deployments utilize static or vetted API specifications, services that consume external or user-supplied specifications face severe availability disruption whenever affected endpoints are exercised.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100349"
},
{
"category": "external",
"summary": "RHBZ#2553589",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553589"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100349"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100349",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100349"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459",
"url": "https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/releases/tag/v0.146.0",
"url": "https://github.com/getkin/kin-openapi/releases/tag/v0.146.0"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f",
"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f"
}
],
"release_date": "2026-10-15T15:50:37.453000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil pointer dereference in response validation"
},
{
"cve": "CVE-2026-100350",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-15T15:52:40.679996+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553584"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending requests containing a large number of query parameters to an affected endpoint. Due to redundant regular expression compilation within the parameter decoding loop, processing these requests leads to excessive CPU and memory consumption, potentially degrading application responsiveness or exhausting server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has been rated with a Moderate impact for Red Hat products because, although remotely triggerable without authentication, the blast radius is confined to service availability degradation without compromising system integrity or confidentiality. In typical deployments, successful exploitation requires application endpoints to enforce OpenAPI schema validation on routes that define deepObject-style query parameters. Services that do not utilize openapi3filter request validation or that do not expose endpoints accepting deepObject parameters are not susceptible to this resource exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100350"
},
{
"category": "external",
"summary": "RHBZ#2553584",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553584"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100350"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100350",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100350"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f",
"url": "https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/releases/tag/v0.146.0",
"url": "https://github.com/getkin/kin-openapi/releases/tag/v0.146.0"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc",
"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc"
}
],
"release_date": "2026-10-15T15:37:19.077000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding"
},
{
"cve": "CVE-2026-100351",
"cwe": {
"id": "CWE-289",
"name": "Authentication Bypass by Alternate Name"
},
"discovery_date": "2026-10-15T16:01:25.836287+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553587"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in kin-openapi. An unauthenticated remote attacker can bypass authentication checks on protected routes by sending requests containing encoded path separators. This issue occurs because the request validation handler inspects the decoded URL path, while certain downstream routers dispatch requests using the raw encoded path. As a result, a request can be mistakenly treated as public and forwarded to a protected handler without required authentication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/getkin/kin-openapi: kin-openapi: Authentication bypass via URL path decoding discrepancy",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote attacker can bypass authentication enforcement and reach protected API handlers, potentially compromising data confidentiality and integrity. Exploitation requires specific architectural preconditions, including downstream routers configured to preserve encoded paths alongside overlapping public and parameterized endpoints. In typical deployments where reverse proxies normalize or canonicalize request paths before forwarding, or where handlers perform independent access control checks, exposure is substantially curtailed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100351"
},
{
"category": "external",
"summary": "RHBZ#2553587",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553587"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100351"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041",
"url": "https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/releases/tag/v0.147.0",
"url": "https://github.com/getkin/kin-openapi/releases/tag/v0.147.0"
},
{
"category": "external",
"summary": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5",
"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5"
}
],
"release_date": "2026-10-15T15:52:30.041000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/getkin/kin-openapi: kin-openapi: Authentication bypass via URL path decoding discrepancy"
},
{
"cve": "CVE-2026-101899",
"cwe": {
"id": "CWE-1025",
"name": "Comparison Using Wrong Factors"
},
"discovery_date": "2026-10-13T16:01:53.491379+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550659"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. This vulnerability allows information disclosure when network traffic intended to bypass a proxy is improperly routed through it. Axios fails to parse Classless Inter-Domain Routing (CIDR) notation in proxy bypass lists as IP address ranges, treating them as plain text hostnames instead. As a result, an adversary with access to the configured proxy server can intercept or inspect sensitive request data and connection metadata intended for internal network services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure via improper CIDR proxy bypass handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A moderate information disclosure vulnerability was found in Axios, a promise-based HTTP client for Node.js that Red Hat Hardened Images (Hummingbird) ships as a dependency of its grafana12.4, grafana13.1, and grafana13.2 container images. Axios evaluates Classless Inter-Domain Routing (CIDR) notation entries in NO_PROXY proxy-bypass lists as textual hostname suffixes instead of IP address ranges. When a request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured, the CIDR bypass rule fails to match and the request is sent through the configured proxy. As a result, an adversary with access to the configured proxy server can observe and modify URLs, headers, and bodies of plaintext HTTP traffic intended for internal network services, and can observe connection metadata and CONNECT requests for HTTPS traffic. Red Hat rated this flaw as moderate severity (CVSS 6.5), consistent with the upstream assessment of moderate severity (CVSS 6.9). The resolution of this issue in the affected Hardened Images streams is delegated to the Hummingbird image maintainers, and a fix has been delivered through the affected image streams.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-101899"
},
{
"category": "external",
"summary": "RHBZ#2550659",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550659"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-101899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-101899"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-101899",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101899"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/11141",
"url": "https://github.com/axios/axios/pull/11141"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.20.0",
"url": "https://github.com/axios/axios/releases/tag/v1.20.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx",
"url": "https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx"
}
],
"release_date": "2026-10-13T15:49:51.223000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The affected Red Hat Hardened Images releases containing the fix have been delivered; update to the latest grafana12.4, grafana13.1, and grafana13.2 image releases to resolve this issue.",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "axios: Axios: Information disclosure via improper CIDR proxy bypass handling"
},
{
"cve": "CVE-2026-109855",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-10-15T08:33:55.008957+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553103"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A malicious remote server can cause a Denial of Service (DoS) by returning an invalid handshake response when a client attempts to establish a WebSocket connection over HTTP/2. The client mishandles the failed connection setup and leaves the underlying network stream open without an error handler. When the remote server subsequently terminates the connection, an unhandled error is raised, causing the application process to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important impact because an unauthenticated remote endpoint can trigger an unhandled exception that terminates the entire Node.js application process, resulting in a complete denial of service. The risk primarily impacts client applications or services configured to open outbound WebSocket sessions over HTTP/2 to untrusted or external servers. In typical Red Hat environments, many bundled container services connect exclusively to controlled internal infrastructure, substantially reducing the likelihood of encountering an adversarial endpoint.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109855"
},
{
"category": "external",
"summary": "RHBZ#2553103",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553103"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109855",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109855"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp"
}
],
"release_date": "2026-10-15T08:12:51.245000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-06T08:26:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:76677"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@aarch64",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@src",
"Red Hat Hardened Images:grafana12.4-0:12.4.12-0.4.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.