Threats Tagged 'cve-2026-49978'

Red Hat Ansible Automation Platform 2.1 delivers an Ansible-first Red Hat Developer Hub user experience that simplifies the automation experience for Ansible users of all skill levels. The Ansible plug-ins provide curated content and features to accelerate Ansible learner onboarding and streamline Ansible use case adoption across your organization.

Red Hat Data Grid 8.6.3 addresses multiple security vulnerabilities including denial of service, information disclosure, cross-site scripting, and security bypass issues primarily in Netty components and related libraries. These vulnerabilities affect the in-memory distributed NoSQL datastore solution and could impact availability, confidentiality, and integrity. The update replaces version 8.6.2 and includes fixes for a range of CVEs such as CVE-2026-44891 (Netty STOMP decoder DoS) and CVE-2026-49978 (DOMPurify XSS).

Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale. Data Grid 8.6.3 replaces Data Grid 8.6.2 and includes bug fixes and enhancements. Find out more about Data Grid 8.6.3 in the Release Notes[3]. Security Fix(es): * CVE-2026-68494 jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [jdg-8.6] (CVE-2026-68494) * CVE-2026-56745 datagrid-8/datagrid-8: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [jdg-8.6] (CVE-2026-56745) * CVE-2026-62243 netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration [jdg-8.6] (CVE-2026-62243) * CVE-2026-73508 netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names [jdg-8.6] (CVE-2026-73508) * CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution [jdg-8.6] (CVE-2026-49978) * CVE-2026-76844 redhat-datagrid-maven-repository.zip: webpack-dev-middleware: Information Disclosure via Path Traversal [jdg-8.6] (CVE-2026-76844) * CVE-2026-59901 netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2) [jdg-8.6] (CVE-2026-59901) * CVE-2026-59899 netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [jdg-8.6] (CVE-2026-59899) * CVE-2026-56820 netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack [jdg-8.6] (CVE-2026-56820) * CVE-2026-56819 netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak [jdg-8.6] (CVE-2026-56819) * CVE-2026-56817 netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability [jdg-8.6] (CVE-2026-56817) * CVE-2026-56746 netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [jdg-8.6] (CVE-2026-56746) * CVE-2026-55851 netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message [jdg-8.6] (CVE-2026-55851) * CVE-2026-55831 netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [jdg-8.6] (CVE-2026-55831) * CVE-2026-55833 netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [jdg-8.6] (CVE-2026-55833) * CVE-2026-44891 netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder [jdg-8.6] (CVE-2026-44891) * CVE-2026-59296 micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing [jdg-8.6] (CVE-2026-59296) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.22.7. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:44237 Security Fix(es): * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization (CVE-2026-13676) * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.10. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2026:54768 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Security Fix(es): * Apache HttpComponents Core: Denial of Service via excessive HTTP headers (CVE-2026-54399) * Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks (CVE-2026-54428) * Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects (CVE-2026-15075) * Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation (CVE-2026-15076) * SeaweedFS: Information disclosure via S3 API gateway path traversal (CVE-2026-55874) * SeaweedFS: Unauthorized data deletion via path traversal in S3 gateway (CVE-2026-58372) * protobufjs: Denial of Service via crafted .proto schema (CVE-2026-59877) * Quarkus REST: Unbounded multipart MIME part-header accumulation allows remote OOM denial of service (CVE-2026-16308) * Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833) * Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831) * Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message (CVE-2026-55851) * Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec (CVE-2026-56745) * Netty: Security control bypass allows unauthorized requests via null origin header (CVE-2026-56746) * Netty: Denial of Service via HTTP/2 DATA frame memory leak (CVE-2026-56819) * Netty: Memory exhaustion in netty-codec-http (decompression bomb) (CVE-2026-59899) * Apache Thrift: Denial of Service via integer overflow or wraparound (CVE-2026-55969) * Apache Thrift: Denial of Service via improper handling of highly compressed data (CVE-2026-48586) * Apache Thrift: Denial of Service due to uncontrolled resource allocation (CVE-2026-45112) * brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVE-2026-69152) * ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) * jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494) * DOMPurify: Cross-site scripting vulnerability allows code execution (CVE-2026-49978) * OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * Go net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * Go encoding/xml: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) * Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * Go crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869) * golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions (CVE-2026-56854) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.30 release is based on Eclipse Che 7.121 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2. Users still using the v1 standard should migrate as soon as possible. https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates. https://access.redhat.com/support/policy/updates/openshift#crw

This release of Red Hat build of Apicurio Registry 3.3.1 GA includes the following security fixes. Security Fix(es): * DOMPurify: Cross-site scripting vulnerability allows code execution [rhint-serv-3] (CVE-2026-49978) * apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS [rhint-serv-3] (CVE-2026-12975) * apicurio-registry: SSRF via wsdl4j import dereference in WSDL FULL validation [rhint-serv-3] (CVE-2026-12992) * apicurio-registry: XML entity-expansion denial of service via internal DTD subset [rhint-serv-3] (CVE-2026-12993) * Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name [rhint-serv-3] (CVE-2026-44496) * DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization [rhint-serv-3] (CVE-2026-41240) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.44. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:57401 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge device deployments and is built from the edge capabilities of Red Hat OpenShift Container Platform. MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at the edge, providing an efficient way to operate single-node clusters in these low-resource environments. This advisory contains the RPM packages for Red Hat build of MicroShift 4.19.42. Read the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:51007 Security Fix(es): * Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code (CVE-2026-35469) All Red Hat build of MicroShift 4.19 users are advised to use these updated packages and images when they are available in the RPM repository.