Skip to content
OpenAdvisories
High RHSA-2026:50290 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Aug 5, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.6-0.4.hum1

Vulnerabilities 3

  • High 7.5
    CVE-2026-14257

    brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

    brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace grou…

    juliangruber brace-expansion langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-69152

    brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing a…

    juliangruber brace-expansion langfuse-3-worker katib-suggestion-hyperopt Ubuntu Azure Linux Wolfi npm
  • Medium 6.3
    CVE-2026-69153

    PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by suppl…

    postcss postcss langfuse-3-worker renovate Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-14257
  • report
    https://access.redhat.com/security/cve/CVE-2026-69152
  • report
    https://access.redhat.com/security/cve/CVE-2026-69153
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50290.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506433
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-14257
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-14257
  • article
    https://github.com/juliangruber/brace-expansion
  • article
    https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5
  • article
    https://www.npmjs.com/package/brace-expansion
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510722
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-69152
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-69152
  • article
    https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
  • article
    https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
  • article
    https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
  • article
    https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
  • article
    https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510719
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-69153
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-69153
  • article
    https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
  • article
    https://github.com/postcss/postcss/releases/tag/8.5.19
  • article
    https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp