Skip to content
OpenAdvisories
High RHSA-2026:37385 3 CVEs

Red Hat Security Advisory: rh-podman-desktop security advisory update

Published Jul 10, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 rh-podman-desktop 0:1.1.1-1.el10_2

Vulnerabilities 3

  • High 7.7
    CVE-2026-44293

    protobufjs: Code injection through bytes field defaults in generated toObject code

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted…

    protobufjs protobuf.js renovate kubeflow-centraldashboard Wolfi npm
  • High 7.5
    CVE-2026-6321

    fast-uri vulnerable to path traversal via percent-encoded dot segments

    fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse on…

    fast-uri fast-uri langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-6322

    fast-uri vulnerable to host confusion via percent-encoded authority delimiters

    fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with…

    fast-uri fast-uri langfuse-3-worker prism Debian Ubuntu Wolfi npm

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://issues.redhat.com/browse/RHEL-182245
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37385.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-6321
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2466582
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6321
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6321
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6
  • report
    https://access.redhat.com/security/cve/CVE-2026-6322
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2466684
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6322
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6322
  • article
    https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc
  • report
    https://access.redhat.com/security/cve/CVE-2026-44293
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477104
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44293
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44293
  • article
    https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm