Skip to content
OpenAdvisories
High RHSA-2026:49401 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Aug 4, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.6-0.3.hum1

Vulnerabilities 3

  • High 7.5
    CVE-2026-18446

    fast-uri vulnerable to host confusion via backslash authority introducer

    fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is pa…

    fast-uri fast-uri langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2026-69198

    ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is short…

    beaugunderson ip-address langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2026-67319

    axios before 0.33.0 Prototype Pollution via nested option objects

    axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null protot…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-18446
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-67319
  • report
    https://access.redhat.com/security/cve/CVE-2026-69198
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49401.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509801
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-18446
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-18446
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510023
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67319
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67319
  • article
    https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq
  • article
    https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510803
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-69198
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-69198
  • article
    https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d
  • article
    https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2
  • article
    https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh