Vulnerability-Lookup

RHSA-2026:93608

Vulnerability from csaf_redhat - Published: 2026-11-02 10:57 - Updated: 2026-11-07 05:56

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: grafana13.1: * grafana13.1-13.1.8-0.6.hum1 (aarch64, s390x, x86_64) * grafana13.1-13.1.8-0.6.hum1.src (src) Security Fix(es): grafana13.1: * CVE-2026-116689 * CVE-2026-116591

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-116591

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard (zstd) compressed stream to an application using the library, resulting in a Denial of Service (DoS). Due to an integer handling error in the decompression logic, the decoder retains stale internal state and performs an out-of-bounds read, triggering an unhandled panic that crashes the application.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-116689

A flaw was found in follow-redirects, which can lead to information disclosure. The library improperly validates the sensitiveHeaders configuration option when handling header lists defined across different execution contexts, causing the list of protected headers to be discarded. Consequently, when an HTTP request is redirected to an external domain, sensitive headers that should be stripped are inadvertently forwarded to the new destination. A remote attacker controlling a redirect target could exploit this vulnerability to intercept confidential authentication credentials.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer

Affected products

Fixed 4 products, the same list as for CVE-2026-116591

Threats

Impact Moderate

References

20 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:93608	self
https://access.redhat.com/security/cve/CVE-2026-116591	external
https://access.redhat.com/security/cve/CVE-2026-116689	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-116591	self
https://bugzilla.redhat.com/show_bug.cgi?id=2561461	external
https://www.cve.org/CVERecord?id=CVE-2026-116591	external
https://nvd.nist.gov/vuln/detail/CVE-2026-116591	external
https://github.com/klauspost/compress/commit/7f5d…	external
https://github.com/klauspost/compress/releases/ta…	external
https://github.com/klauspost/compress/security/ad…	external
https://access.redhat.com/security/cve/CVE-2026-116689	self
https://bugzilla.redhat.com/show_bug.cgi?id=2562364	external
https://www.cve.org/CVERecord?id=CVE-2026-116689	external
https://nvd.nist.gov/vuln/detail/CVE-2026-116689	external
https://github.com/follow-redirects/follow-redire…	external
https://github.com/follow-redirects/follow-redire…	external
https://github.com/follow-redirects/follow-redire…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.1:\n  * grafana13.1-13.1.8-0.6.hum1 (aarch64, s390x, x86_64)\n  * grafana13.1-13.1.8-0.6.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana13.1:\n  * CVE-2026-116689\n  * CVE-2026-116591",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:93608",
        "url": "https://access.redhat.com/errata/RHSA-2026:93608"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-116591",
        "url": "https://access.redhat.com/security/cve/CVE-2026-116591"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-116689",
        "url": "https://access.redhat.com/security/cve/CVE-2026-116689"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93608.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-11-07T05:56:02+00:00",
      "generator": {
        "date": "2026-11-07T05:56:02+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:93608",
      "initial_release_date": "2026-11-02T10:57:17+00:00",
      "revision_history": [
        {
          "date": "2026-11-02T10:57:17+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-02T11:00:10+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-07T05:56:02+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.1-0:13.1.8-0.6.hum1@aarch64",
                "product": {
                  "name": "grafana13.1-0:13.1.8-0.6.hum1@aarch64",
                  "product_id": "grafana13.1-0:13.1.8-0.6.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.8-0.6.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.1-0:13.1.8-0.6.hum1@s390x",
                "product": {
                  "name": "grafana13.1-0:13.1.8-0.6.hum1@s390x",
                  "product_id": "grafana13.1-0:13.1.8-0.6.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.8-0.6.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.1-0:13.1.8-0.6.hum1@src",
                "product": {
                  "name": "grafana13.1-0:13.1.8-0.6.hum1@src",
                  "product_id": "grafana13.1-0:13.1.8-0.6.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.8-0.6.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.1-0:13.1.8-0.6.hum1@x86_64",
                "product": {
                  "name": "grafana13.1-0:13.1.8-0.6.hum1@x86_64",
                  "product_id": "grafana13.1-0:13.1.8-0.6.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.8-0.6.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.1-0:13.1.8-0.6.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@aarch64"
        },
        "product_reference": "grafana13.1-0:13.1.8-0.6.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.1-0:13.1.8-0.6.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@s390x"
        },
        "product_reference": "grafana13.1-0:13.1.8-0.6.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.1-0:13.1.8-0.6.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@src"
        },
        "product_reference": "grafana13.1-0:13.1.8-0.6.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.1-0:13.1.8-0.6.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@x86_64"
        },
        "product_reference": "grafana13.1-0:13.1.8-0.6.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-116591",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-10-26T22:34:28.681138+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2561461"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard (zstd) compressed stream to an application using the library, resulting in a Denial of Service (DoS). Due to an integer handling error in the decompression logic, the decoder retains stale internal state and performs an out-of-bounds read, triggering an unhandled panic that crashes the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the klauspost compress library\u0027s Zstandard (zstd) decompression implementation. An integer handling flaw in the FSE normalized count parsing logic allows a remote attacker to supply a specially crafted two-block compressed stream. When processed by vulnerable decode routines, the parser retains stale decode-table state and executes an out-of-bounds read, triggering an unhandled runtime panic. Applications decompressing untrusted inputs will terminate abruptly, causing a denial of service, while container boundaries and non-root execution isolate the impact from the underlying host.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@s390x",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-116591"
        },
        {
          "category": "external",
          "summary": "RHBZ#2561461",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561461"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-116591",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-116591"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116591",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116591"
        },
        {
          "category": "external",
          "summary": "https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d",
          "url": "https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d"
        },
        {
          "category": "external",
          "summary": "https://github.com/klauspost/compress/releases/tag/v1.20.2",
          "url": "https://github.com/klauspost/compress/releases/tag/v1.20.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8",
          "url": "https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8"
        }
      ],
      "release_date": "2026-10-26T21:54:33.109000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T10:57:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93608"
        },
        {
          "category": "workaround",
          "details": "Reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. No direct configuration-level workaround exists within the library itself.\n\n--- CME Mitigation Guidance (2026-11-03) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce bounds on parsed count values and decode-table indices in klauspost/compress zstd decompression routines to prevent integer wraparound and out-of-bounds indexing: upgrade to klauspost/compress 1.20.2+ (or the corresponding fixed Red Hat builds), which reject counts exceeding math.MaxInt16 in readNCount, restrict Huffman-weight FSE tableLog values to 6 in huff0.ReadTable, and adjust count validation in validateNorm, closing crafted two-block zstd compressed stream. Until patched, this is a concern on applications decompressing untrusted Zstandard (zstd) input using klauspost/compress DecodeAll or streaming decoder, so reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wraparound defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input"
    },
    {
      "cve": "CVE-2026-116689",
      "cwe": {
        "id": "CWE-212",
        "name": "Improper Removal of Sensitive Information Before Storage or Transfer"
      },
      "discovery_date": "2026-10-27T19:52:10.017634+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2562364"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in follow-redirects, which can lead to information disclosure. The library improperly validates the sensitiveHeaders configuration option when handling header lists defined across different execution contexts, causing the list of protected headers to be discarded. Consequently, when an HTTP request is redirected to an external domain, sensitive headers that should be stripped are inadvertently forwarded to the new destination. A remote attacker controlling a redirect target could exploit this vulnerability to intercept confidential authentication credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because exploitation requires an attacker to induce HTTP requests toward a malicious host that triggers cross-origin redirects while specific cross-realm array environments are in use. Applications bundled within Red Hat products are only vulnerable if they configure custom sensitive header filtering and make requests to untrusted or compromised endpoints. The risk is constrained to header data disclosure without permitting arbitrary code execution or broader system compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@s390x",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-116689"
        },
        {
          "category": "external",
          "summary": "RHBZ#2562364",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562364"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-116689",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-116689"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116689",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116689"
        },
        {
          "category": "external",
          "summary": "https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8",
          "url": "https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8"
        },
        {
          "category": "external",
          "summary": "https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2",
          "url": "https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p",
          "url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p"
        }
      ],
      "release_date": "2026-10-27T19:38:46.034000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T10:57:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:93608"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@s390x",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.8-0.6.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects"
    }
  ]
}

CVE-2026-116591 (GCVE-0-2026-116591)

Vulnerability from cvelistv5 – Published: 2026-10-26 21:54 – Updated: 2026-10-27 14:16

Title

compress zstd: Panic on two-block frames

Summary

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 13:46 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/klauspost/compress/security/ad…	x_refsource_CONFIRM
https://github.com/klauspost/compress/commit/7f5d…	x_refsource_MISC
https://github.com/klauspost/compress/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
klauspost	compress	Affected: < 1.20.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116591",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T13:46:04.382421Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T14:16:30.395Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compress",
          "vendor": "klauspost",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.20.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T21:55:20.476Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8"
        },
        {
          "name": "https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d"
        },
        {
          "name": "https://github.com/klauspost/compress/releases/tag/v1.20.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klauspost/compress/releases/tag/v1.20.2"
        }
      ],
      "source": {
        "advisory": "GHSA-fpmh-frq8-7rj8",
        "discovery": "UNKNOWN"
      },
      "title": "compress zstd: Panic on two-block frames"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116591",
    "datePublished": "2026-10-26T21:54:33.109Z",
    "dateReserved": "2026-10-26T15:03:39.037Z",
    "dateUpdated": "2026-10-27T14:16:30.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116689 (GCVE-0-2026-116689)

Vulnerability from cvelistv5 – Published: 2026-10-27 19:38 – Updated: 2026-10-30 18:47

Title

follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

Summary

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 18:47 UTC

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/follow-redirects/follow-redire…	x_refsource_CONFIRM
https://github.com/follow-redirects/follow-redire…	x_refsource_MISC
https://github.com/follow-redirects/follow-redire…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
follow-redirects	follow-redirects	Affected: >= 1.16.0, < 1.16.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116689",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T18:47:47.826619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:47:54.616Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "follow-redirects",
          "vendor": "follow-redirects",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.16.0, \u003c 1.16.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T19:38:46.034Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p"
        },
        {
          "name": "https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8"
        },
        {
          "name": "https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2"
        }
      ],
      "source": {
        "advisory": "GHSA-mrwp-f3q8-3g9p",
        "discovery": "UNKNOWN"
      },
      "title": "follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116689",
    "datePublished": "2026-10-27T19:38:46.034Z",
    "dateReserved": "2026-10-26T20:00:59.830Z",
    "dateUpdated": "2026-10-30T18:47:54.616Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:93608

CVE-2026-116591 (GCVE-0-2026-116591)

CVE-2026-116689 (GCVE-0-2026-116689)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour