Red Hat Security Advisory: Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
The Cryostat 4 on RHEL 9 container images have been updated to fix several bugs. Users of Cryostat 4 on RHEL 9 container images are advised to upgrade to these updated images, which contain backported patches to fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images. Security Fix(es): * golang.org/x/image: Denial of Service via malformed WEBP image parsing (CVE-2026-33813) * follow-redirects: Information disclosure via cross-domain redirects (CVE-2026-40895) * io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests (CVE-2026-39852) * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33815, CVE-2026-33816) * github.com/go-jose/go-jose: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800) * netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871) * io.netty/netty-codec-http: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values (CVE-2026-33870) * path-to-regexp: Denial of Service via crafted regular expressions (CVE-2026-4926) * undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * google.golang.org/grpc: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files (CVE-2026-1002) You can find images updated by this advisory in the Red Hat Container Catalog (see the References section).
AI Analysis
Technical Summary
The Cryostat 4 on RHEL 9 container images have been updated by Red Hat to fix a collection of security vulnerabilities affecting multiple third-party libraries and components such as golang.org/x/image, follow-redirects, io.quarkus, github.com/jackc/pgx, go-jose, lodash, netty, path-to-regexp, undici, google.golang.org/grpc, and io.vertx/vertx-core. The vulnerabilities include denial of service via malformed inputs and resource exhaustion, authorization bypass through improper HTTP request parsing, information disclosure via cross-domain redirects, request smuggling, memory safety flaws, and arbitrary code execution via untrusted template imports. The advisory recommends upgrading to the new container images that contain backported patches and rebuilding all dependent container images. The update is rated as having an Important security impact by Red Hat Product Security.
Potential Impact
The vulnerabilities fixed in this update can lead to denial of service conditions, unauthorized access bypass, information disclosure, memory safety violations, request smuggling attacks, and arbitrary code execution. These issues affect the Cryostat 4 container images running on RHEL 9 and could potentially disrupt service availability, compromise data confidentiality, or allow execution of malicious code if exploited.
Mitigation Recommendations
Red Hat has released updated Cryostat 4.2.0 container images on RHEL 9 that include backported patches addressing these vulnerabilities. Users should upgrade to these updated container images available from the Red Hat Container Registry and rebuild any container images that depend on them. No additional mitigation steps are indicated beyond applying the updated images.
Red Hat Security Advisory: Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
Description
The Cryostat 4 on RHEL 9 container images have been updated to fix several bugs. Users of Cryostat 4 on RHEL 9 container images are advised to upgrade to these updated images, which contain backported patches to fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images. Security Fix(es): * golang.org/x/image: Denial of Service via malformed WEBP image parsing (CVE-2026-33813) * follow-redirects: Information disclosure via cross-domain redirects (CVE-2026-40895) * io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests (CVE-2026-39852) * github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33815, CVE-2026-33816) * github.com/go-jose/go-jose: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800) * netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871) * io.netty/netty-codec-http: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values (CVE-2026-33870) * path-to-regexp: Denial of Service via crafted regular expressions (CVE-2026-4926) * undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * google.golang.org/grpc: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files (CVE-2026-1002) You can find images updated by this advisory in the Red Hat Container Catalog (see the References section).
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Cryostat 4 on RHEL 9 container images have been updated by Red Hat to fix a collection of security vulnerabilities affecting multiple third-party libraries and components such as golang.org/x/image, follow-redirects, io.quarkus, github.com/jackc/pgx, go-jose, lodash, netty, path-to-regexp, undici, google.golang.org/grpc, and io.vertx/vertx-core. The vulnerabilities include denial of service via malformed inputs and resource exhaustion, authorization bypass through improper HTTP request parsing, information disclosure via cross-domain redirects, request smuggling, memory safety flaws, and arbitrary code execution via untrusted template imports. The advisory recommends upgrading to the new container images that contain backported patches and rebuilding all dependent container images. The update is rated as having an Important security impact by Red Hat Product Security.
Potential Impact
The vulnerabilities fixed in this update can lead to denial of service conditions, unauthorized access bypass, information disclosure, memory safety violations, request smuggling attacks, and arbitrary code execution. These issues affect the Cryostat 4 container images running on RHEL 9 and could potentially disrupt service availability, compromise data confidentiality, or allow execution of malicious code if exploited.
Mitigation Recommendations
Red Hat has released updated Cryostat 4.2.0 container images on RHEL 9 that include backported patches addressing these vulnerabilities. Users should upgrade to these updated container images available from the Red Hat Container Registry and rebuild any container images that depend on them. No additional mitigation steps are indicated beyond applying the updated images.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:17789
- Cve Count
- 16
- Additional Cves
- ["CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-4800","CVE-2026-4926","CVE-2026-33186","CVE-2026-33813","CVE-2026-33815","CVE-2026-33816","CVE-2026-33870","CVE-2026-33871","CVE-2026-34986","CVE-2026-39852","CVE-2026-40895"]
- Cvss Version
- null
Threat ID: 6a160955e29bf47b5061a236
Added to database: 05/26/2026, 20:57:57 UTC
Last enriched: 07/26/2026, 01:43:42 UTC
Last updated: 07/31/2026, 21:50:45 UTC
Views: 119
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.