Skip to content
OpenAdvisories
High RHSA-2026:76677 12 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Oct 10, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.12-0.4.hum1

Vulnerabilities 12

  • High 8.2
    CVE-2026-100349

    kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes valid…

    getkin kin-openapi grafana-13.0 github.com/getkin/kin-openapi Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2024-24786

    Infinite loop in JSON unmarshaling in google.golang.org/protobuf

    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown opti…

    google.golang.org/protobuf google.golang.org/protobuf/internal/encoding/json google.golang.org/protobuf/encoding/protojson katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-109855

    undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

    undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, s…

    undici undici node-undici node-undici Debian Ubuntu npm
  • High 7.5
    CVE-2026-56851

    Panic parsing crafted input in x/text/secure/precis in golang.org/x/text

    The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

    golang.org/x/text golang.org/x/text/secure/precis renovate trino Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2026-97394

    kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or …

    getkin kin-openapi github.com/getkin/kin-openapi golang-github-getkin-kin-openapi Ubuntu Go
  • High 7.4
    CVE-2026-100351

    kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

    kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a diff…

    getkin kin-openapi kubevela-vela-cli kubevela-vela-core Ubuntu Wolfi Go
  • Medium 6.9
    CVE-2026-101899

    Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

    Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a C…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • Medium 5.5
    CVE-2026-61801

    github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

    The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allow…

    moby sys zarf k3d Debian Ubuntu Azure Linux Wolfi Go
  • Medium 5.3
    CVE-2026-100347

    kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. …

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-100348

    kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-100350

    kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

    kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode…

    getkin kin-openapi github.com/getkin/kin-openapi golang-github-getkin-kin-openapi Ubuntu Go
  • Medium 5.3
    CVE-2026-95502

    Git Sync memory exhaustion via a malicious Git server

    A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync…

    Grafana Grafana OSS Grafana Enterprise Nanogit Web / CMS

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-56851
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-61801
  • report
    https://access.redhat.com/security/cve/CVE-2024-24786
  • report
    https://access.redhat.com/security/cve/CVE-2026-95502
  • report
    https://access.redhat.com/security/cve/CVE-2026-101899
  • report
    https://access.redhat.com/security/cve/CVE-2026-109855
  • report
    https://access.redhat.com/security/cve/CVE-2026-100347
  • report
    https://access.redhat.com/security/cve/CVE-2026-100348
  • report
    https://access.redhat.com/security/cve/CVE-2026-100349
  • report
    https://access.redhat.com/security/cve/CVE-2026-100350
  • report
    https://access.redhat.com/security/cve/CVE-2026-100351
  • report
    https://access.redhat.com/security/cve/CVE-2026-97394
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76677.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268046
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-24786
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-24786
  • article
    https://go.dev/cl/569356
  • article
    https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/
  • advisory
    https://pkg.go.dev/vuln/GO-2024-2611
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2547607
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-56851
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-56851
  • article
    https://go.dev/cl/793360
  • article
    https://go.dev/issue/80112
  • advisory
    https://pkg.go.dev/vuln/GO-2026-6629
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2548048
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-61801
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-61801
  • article
    https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe
  • article
    https://github.com/moby/sys/pull/221
  • article
    https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550709
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-95502
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-95502
  • article
    https://grafana.com/security/security-advisories/cve-2026-95502
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553575
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-97394