Skip to content
OpenAdvisories
High RHSA-2026:82637 9 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Oct 17, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 hugo 0:0.168.0-0.1.hum1

Vulnerabilities 9

  • High 8.2
    CVE-2026-100349

    kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes valid…

    getkin kin-openapi grafana-13.0 golang-github-getkin-kin-openapi Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100352

    kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote u…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100353

    kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote cl…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100354

    kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document va…

    getkin kin-openapi kubevela-vela-cli kubevela-vela-core Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-97394

    kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or …

    getkin kin-openapi github.com/getkin/kin-openapi golang-github-getkin-kin-openapi Ubuntu Go
  • High 7.4
    CVE-2026-100351

    kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

    kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a diff…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-100347

    kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. …

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-100348

    kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-100350

    kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

    kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode…

    getkin kin-openapi github.com/getkin/kin-openapi golang-github-getkin-kin-openapi Ubuntu Go

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-100352
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-100353
  • report
    https://access.redhat.com/security/cve/CVE-2026-100347
  • report
    https://access.redhat.com/security/cve/CVE-2026-100348
  • report
    https://access.redhat.com/security/cve/CVE-2026-100349
  • report
    https://access.redhat.com/security/cve/CVE-2026-100350
  • report
    https://access.redhat.com/security/cve/CVE-2026-100351
  • report
    https://access.redhat.com/security/cve/CVE-2026-97394
  • report
    https://access.redhat.com/security/cve/CVE-2026-100354
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82637.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553575
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-97394
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-97394
  • article
    https://github.com/getkin/kin-openapi/commit/30e292371a89ca6d1f91a9553e0aa518b49f838d
  • article
    https://github.com/getkin/kin-openapi/releases/tag/v0.143.0
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553580
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100347
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100347
  • article
    https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3
  • article
    https://github.com/getkin/kin-openapi/releases/tag/v0.145.0
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553571
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100348
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100348
  • article
    https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553589
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100349
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100349
  • article
    https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459
  • article
    https://github.com/getkin/kin-openapi/releases/tag/v0.146.0
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553584
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100350
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100350
  • article
    https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f