A security update for Red Hat Hardened Images RPMs addresses multiple vulnerabilities including CVE-2026-6322. The primary issue involves the fast-uri library incorrectly decoding percent-encoded authority delimiters in URIs, which can lead to bypassing security controls such as host allowlist checks and redirect validation. This update includes fixes for several CVEs affecting the grafana13.1 package. No specific affected versions are listed in the advisory.

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Red Hat OpenShift Container Platform 4.19.43 includes a security update addressing multiple bugs and vulnerabilities. This update is rated as having an important security impact and is intended for on-premise or private cloud Kubernetes deployments. Users are advised to upgrade to the updated container images and RPM packages to apply the fixes.

Red Hat Security Advisory: OpenShift Container Platform 4.19.43 bug fix and security update

Red Hat OpenShift Data Foundation 4.21.11 security, enhancement & bug fix update

FIXED BUGS:
==========
DFBUGS-9563: [Backport to odf-4.21.10] Race condition may allow multiple CephCluster reconciles in parallel
DFBUGS-8999: [odf-4.21] - [GSS] Red Hat Virtualization VMs in Paused State - "VMI was paused, low-level IO error detected" w/rbd Volumes Impacted and Clients Blocklisted
DFBUGS-8997: [4.21] CLONE - The console pod in openshift console is continuously restarting
DFBUGS-8957: RHODF 4.21.11 release
DFBUGS-8200: [Backport to odf-4.21.z] - [GSS] Red Hat Virtualization VMs in Paused State - "VMI was paused, low-level IO error detected" w/rbd Volumes Impacted and Clients Blocklisted
DFBUGS-7048: Hide data replication separation option from UI in 4.21 as its not supported
DFBUGS-7003: [Backport to odf-4.21.z] [GSS][Disconnected env] ODF is upgraded itself from ODF v4.20.2 to ODF v4.20.7 without Manual Approval when upgrdaing OCP v4.20.5 to OCP v4.20.16
DFBUGS-6995: [Backport to odf-4.21.z] [GSS][ODF] Noobaa DB_CLEANER not honoring set value
DFBUGS-6938: [4.21.z] Integrate ibm-storage-odf-operator 1.9.0
DFBUGS-6813: release-4.21 - ODF must-gather missing CR storageclusterpeer.yaml
DFBUGS-6510: CLONE 4.21 - Object Browser sends unnecessary getObject API calls
DFBUGS-6471: CLONE - In storage cluster UI page , tick mark background colour changed from green to black in 4.22
DFBUGS-5965: [OLS]: RAG content image is using ODF 4.20 documentation when deployed on OCP/ODF 4.21
DFBUGS-4988: ocs-metrics-exporter does not provide metrics during cache refresh

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.21.11 security, enhancement & bug fix update

Red Hat Security Advisory: Red Hat Quay 3.17.4

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.

For details about this release, refer to the release notes listed in the References section.

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update

Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale.
 
Data Grid 8.6.2 replaces Data Grid 8.6.1 and includes bug fixes and enhancements. Find out more about Data Grid 8.6.2 in the Release Notes[3].

Security Fix(es):

* CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [jdg-8.6] (CVE-2026-54513)

* CVE-2026-42211 react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode [jdg-8.6] (CVE-2026-42211)

* CVE-2026-42264 axios: Axios: Prototype pollution allows information disclosure and request manipulation [jdg-8.6] (CVE-2026-42264)

* CVE-2026-50193 jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing [jdg-8.6] (CVE-2026-50193)

* CVE-2026-54512 jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [jdg-8.6] (CVE-2026-54512)

* CVE-2026-40983 micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests [jdg-8.6] (CVE-2026-40983)

* CVE-2026-40984 micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests [jdg-8.6] (CVE-2026-40984)

* CVE-2026-12143 form-data: form-data: Form field override via CRLF injection [jdg-8.6] (CVE-2026-12143)

* CVE-2026-9595 webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration [jdg-8.6] (CVE-2026-9595)

* CVE-2026-50011 netty-codec-redis: Netty: Denial of Service via malicious Redis array header [jdg-8.6] (CVE-2026-50011)

* CVE-2026-45416 netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake [jdg-8.6] (CVE-2026-45416)

* CVE-2026-44890 netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads [jdg-8.6] (CVE-2026-44890)

* CVE-2026-44250 netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays [jdg-8.6] (CVE-2026-44250)

* CVE-2026-46340 netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments [jdg-8.6] (CVE-2026-46340)

* CVE-2026-45674 netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation [jdg-8.6] (CVE-2026-45674)

* CVE-2026-50010 netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass [jdg-8.6] (CVE-2026-50010)

* CVE-2026-48006 netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator [jdg-8.6] (CVE-2026-48006)

* CVE-2026-47691 netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records [jdg-8.6] (CVE-2026-47691)

* CVE-2026-48059 netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers [jdg-8.6] (CVE-2026-48059)
* CVE-2026-48043 netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak [jdg-8.6] (CVE-2026-48043)

* CVE-2026-44893 netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message [jdg-8.6] (CVE-2026-44893)

* CVE-2026-44249 netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation [jdg-8.6] (CVE-2026-44249)

* CVE-2026-44492 axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization [jdg-8.6] (CVE-2026-44492)

* CVE-2026-44494 axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution [jdg-8.6] (CVE-2026-44494)

* CVE-2026-44496 axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name [jdg-8.6] (CVE-2026-44496)

* CVE-2026-44486 axios: Axios: Information disclosure of proxy credentials via HTTP redirects [jdg-8.6] (CVE-2026-44486)

* CVE-2026-44487 axios: Axios: Information disclosure of proxy credentials via redirect flows [jdg-8.6] (CVE-2026-44487)

* CVE-2026-44488 axios: Axios: Denial of Service due to unenforced request and response size limits [jdg-8.6] (CVE-2026-44488)

* CVE-2026-44495 axios: Axios: Information disclosure due to prototype pollution vulnerability [jdg-8.6] (CVE-2026-44495)

* CVE-2026-6322 fast-uri: fast-uri: URI authority bypass due to improper delimiter handling [jdg-8.6] (CVE-2026-6322)

* CVE-2026-45292 opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage [jdg-8.6] (CVE-2026-45292)

* CVE-2026-42583 netty-codec-compression: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder [jdg-8.6] (CVE-2026-42583)

* CVE-2026-44248 netty-codec-mqtt: Netty: Denial of Service due to excessive resource consumption from crafted MQTT 5 header [jdg-8.6] (CVE-2026-44248)

* CVE-2026-42587 netty-codec-http2: Netty: Denial of Service via unbounded memory allocation 

Red Hat Security Advisory: Red Hat Data Grid 8.6.2 security update

Red Hat Security Advisory: Red Hat Quay 3.16.5

Red Hat OpenShift Container Platform 4.20.29 includes a security update addressing multiple vulnerabilities. This update fixes bugs and enhances security for on-premise or private cloud Kubernetes deployments. Users are advised to upgrade to this release to mitigate the identified issues.

Red Hat Security Advisory: OpenShift Container Platform 4.20.29 bug fix and security update

Red Hat Developer Hub (RHDH) 1.10.2 addresses multiple issues including a significant vulnerability (CVE-2026-12143) in the form-data library. This vulnerability allows remote attackers to inject carriage return, line feed, or double-quote characters into multipart form-data field names or filenames, potentially enabling header injection or multipart form smuggling. The impact is limited in default deployments due to fixed field names, but custom integrations using untrusted input may be affected. The advisory includes fixes for several bugs and security issues in RHDH 1.10.2.

Red Hat Security Advisory: Red Hat Developer Hub 1.10.2 release.

Red Hat OpenShift Container Platform 4.19.37 includes a security update addressing multiple bugs and vulnerabilities. This update is rated as having an important security impact by Red Hat Product Security. The advisory provides updated container images and references RPM package updates in a separate advisory. Users of OpenShift Container Platform 4.19 are advised to upgrade to these updated packages and images to apply the fixes.

Red Hat Security Advisory: OpenShift Container Platform 4.19.37 bug fix and security update

Red Hat OpenShift Container Platform 4.21.23 includes a security update addressing a vulnerability in the fast-uri component that allows URI authority bypass due to improper delimiter handling (CVE-2026-6322). This update is rated as having an important security impact. Users of OpenShift Container Platform 4.21 are advised to upgrade to the updated packages and images to mitigate this issue.

Red Hat Security Advisory: OpenShift Container Platform 4.21.23 security and extras update

Red Hat has issued a security advisory for Red Hat Ansible Automation Platform 2.6 container release update addressing multiple security issues. The update includes fixes for several CVEs, including CVE-2026-6322, among others. The advisory emphasizes applying all previously released errata before this update. The Ansible Automation Platform enables enterprise IT automation management and this update improves its security posture.

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

Red Hat Ansible Automation Platform 2.6 has multiple security vulnerabilities affecting various components such as automation-platform-ui, python3.12-pyjwt, automation-controller, and python3.12-urllib3. These include denial of service, information disclosure, authentication bypass, cross-site scripting, arbitrary code execution, and server-side template injection. Red Hat has released an important security update addressing these issues.

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Red Hat Quay 3.10.23 addresses multiple security vulnerabilities including CVE-2026-6322 and others. One notable vulnerability (CVE-2026-10143) affects kafka-python, where a malicious broker can cause a denial-of-service by providing an excessively large SCRAM authentication iteration count, freezing the client's event loop and disrupting critical operations. The advisory indicates that no fixes are currently available for these issues in Red Hat Quay 3.10.23, which is primarily a bug fix release. Users are advised to apply all previously released errata before updating.

Red Hat Security Advisory: Red Hat Quay 3.10.23

Red Hat OpenShift Container Platform 4.20.27 includes a security update addressing vulnerabilities identified by CVE-2026-6322. This update fixes bugs and enhances security for on-premise or private cloud Kubernetes deployments. Users of OpenShift Container Platform 4.20 are advised to upgrade to this release to apply the security fixes.

Red Hat Security Advisory: OpenShift Container Platform 4.20.27 bug fix and security update

Red Hat OpenShift Container Platform 4.22.3 includes a security update addressing a vulnerability in the fast-uri component. The flaw (CVE-2026-6322) involves a URI authority bypass caused by improper delimiter handling. Users of OpenShift Container Platform 4.22 are advised to upgrade to this release to mitigate the issue.

Red Hat Security Advisory: OpenShift Container Platform 4.22.3 security and extras update

Red Hat OpenShift Container Platform 4.21.22 includes a security update addressing multiple bugs and vulnerabilities. This update is rated as having an important security impact and is intended for on-premise or private cloud Kubernetes deployments. Users of OpenShift Container Platform 4.21 are advised to upgrade to the updated container images and packages to apply the fixes.

Red Hat Security Advisory: OpenShift Container Platform 4.21.22 bug fix and security update

Red Hat Quay 3.12.19 includes fixes for multiple security vulnerabilities, including CVE-2026-6322 and others. One notable vulnerability (CVE-2026-10143) affects kafka-python and allows a malicious or man-in-the-middle broker to cause a denial-of-service by providing an excessively large SCRAM authentication iteration count, freezing the client's event loop and disrupting critical operations. No specific affected versions of Red Hat Quay are stated. The advisory recommends applying the update 3.12.19 after ensuring all previous errata are applied.

Red Hat Security Advisory: Red Hat Quay 3.12.19

Red Hat Quay 3.9.23 addresses multiple security vulnerabilities including CVE-2026-6322 and others. One notable issue is a denial-of-service vulnerability in kafka-python during SCRAM authentication, where a malicious broker can cause the client's event loop to freeze by providing an excessively large iteration count. This prevents critical client operations and leads to persistent connection failures. The advisory indicates that fixes are included in Red Hat Quay 3.9.23, and users should apply this update after ensuring previous errata are applied.

Red Hat Security Advisory: Red Hat Quay 3.9.23

Red Hat has issued a security advisory for a technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image used in Red Hat Satellite. The advisory references multiple CVEs, including CVE-2026-6322, affecting Red Hat Lightspeed in Satellite, which analyzes system health and configuration. One notable vulnerability (CVE-2026-26996) involves a Regular Expression Denial of Service (ReDoS) in the minimatch component, which could allow a remote attacker to cause a denial of service by supplying specially crafted glob patterns. No fixes have been released yet, and no known exploits are reported in the wild. The advisory provides links to documentation and encourages users to consult Red Hat Satellite documentation for installation and configuration guidance.

Search: CVE-2026-6322