The advisory covers several CVEs affecting the grafana13.1 package in Red Hat Hardened Images, notably CVE-2026-67313, which is a denial of service vulnerability caused by uncontrolled recursion in axios's formDataToJSON function. An attacker can supply FormData with deeply nested bracketed field names, causing stack exhaustion and process termination. The issue is tracked under CWE-674 (Uncontrolled Recursion) and related CWEs. Red Hat has released updated RPMs (grafana13.1-13.1.1-0.5.hum1) for affected architectures. The CVSS v3 score assigned by Red Hat for CVE-2026-67313 is 7.5, indicating a high impact on availability. The advisory does not provide explicit patch links but references Red Hat's image repository for updates. No known exploits in the wild have been reported. The update addresses multiple related CVEs in the same package.

The primary impact is denial of service due to resource exhaustion (CPU, memory, stack) caused by uncontrolled recursion in the axios library used by grafana13.1. This can lead to request failures or process termination, affecting application availability. There is no impact on confidentiality or integrity reported. The vulnerability affects applications using the vulnerable axios version within Red Hat Hardened Images. No active exploitation has been observed.

Red Hat has released updated RPM packages for grafana13.1 (version 13.1.1-0.5.hum1) that address these vulnerabilities. Users should apply these updates from the Red Hat image repositories as soon as possible. No additional mitigations are specified by Red Hat. Patch status is confirmed by the vendor advisory. For details and update instructions, refer to https://images.redhat.com/ and the Red Hat security advisory at https://access.redhat.com/errata/RHSA-2026:49714.