Red Hat OpenShift Dev Spaces 3.26.1 release includes fixes for several CVEs, notably CVE-2025-15467, a critical OpenSSL vulnerability involving a stack buffer overflow triggered by a crafted Cryptographic Message Syntax (CMS) message with an oversized Initialization Vector in AEAD ciphers like AES-GCM. This flaw can cause denial of service or potentially remote code execution, though Red Hat's build includes stack protections mitigating code execution risk, leaving denial of service as the primary impact. The product supports container-based development and runs on OpenShift EUS releases v4.16 and higher. Users are urged to migrate from devfile v1 to v2 standards and update OpenShift accordingly. The advisory confirms that the update 3.26.1 addresses these vulnerabilities and that users should apply it following Red Hat's update procedures.

The vulnerabilities fixed in this release include critical security flaws such as buffer overflows in OpenSSL that can lead to denial of service or potentially remote code execution. Red Hat's OpenSSL build mitigates the risk of code execution via stack protections, but denial of service remains possible. These vulnerabilities affect applications parsing untrusted CMS or PKCS#7 content using AEAD ciphers, including components like Kerberos PKINIT. Failure to update may expose systems to crashes or exploitation attempts targeting these flaws.

A fix is available in Red Hat OpenShift Dev Spaces version 3.26.1. Users should apply this update after ensuring all previously released errata relevant to their system have been installed. Migration from devfile v1 to v2 standards is strongly recommended. Additionally, users should run Dev Spaces on supported OpenShift EUS releases v4.16 or higher to continue receiving updates. Follow Red Hat's official update guidance at https://access.redhat.com/articles/11258 for proper application of this update.