Skip to content
OpenAdvisories
High RHSA-2026:71906 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Sep 26, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana13.2 0:13.2.1-0.7.hum1

Vulnerabilities 4

  • High 7.5
    CVE-2026-93450

    go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

    go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services acce…

    go-openapi swag kubevirt kubevirt-openvmm Azure Linux
  • Medium 5.1
    CVE-2026-75838

    DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

    DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitizati…

    cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm
  • Medium 4.8
    CVE-2026-86472

    fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

    fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-enc…

    fast-uri fast-uri prism jupyter-base-notebook Debian Ubuntu Wolfi npm
  • Medium 4.7
    CVE-2026-93981

    hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

    hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to rend…

    honojs hono hono npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-75838
  • report
    https://access.redhat.com/security/cve/CVE-2026-86472
  • report
    https://access.redhat.com/security/cve/CVE-2026-93450
  • report
    https://access.redhat.com/security/cve/CVE-2026-93981
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71906.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517772
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-75838
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-75838
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
  • article
    https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533679
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-86472
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-86472
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2538979
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-93450
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-93450
  • article
    https://github.com/go-openapi/swag
  • article
    https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68
  • article
    https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214
  • article
    https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e
  • article
    https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28
  • article
    https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2538284
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-93981
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-93981
  • article
    https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv
  • article
    https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings