Skip to content
OpenAdvisories
High RHSA-2026:85266 9 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Oct 20, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana13.2 0:13.2.3-0.3.hum1

Vulnerabilities 9

  • High 8.2
    CVE-2026-100349

    kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes valid…

    getkin kin-openapi grafana-13.0 github.com/getkin/kin-openapi Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100352

    kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote u…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100353

    kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote cl…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100354

    kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document va…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-93450

    go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

    go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services acce…

    go-openapi swag kubevirt kubevirt-openvmm Azure Linux
  • High 7.4
    CVE-2026-100351

    kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

    kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a diff…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-100347

    kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. …

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-100348

    kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-110816

    qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

    ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or a null-pr…

    ljharb qs renovate prism Debian Ubuntu Azure Linux Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-100347
  • report
    https://access.redhat.com/security/cve/CVE-2026-100348
  • report
    https://access.redhat.com/security/cve/CVE-2026-100349
  • report
    https://access.redhat.com/security/cve/CVE-2026-100351
  • report
    https://access.redhat.com/security/cve/CVE-2026-100352
  • report
    https://access.redhat.com/security/cve/CVE-2026-100353
  • report
    https://access.redhat.com/security/cve/CVE-2026-100354
  • report
    https://access.redhat.com/security/cve/CVE-2026-110816
  • report
    https://access.redhat.com/security/cve/CVE-2026-93450
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85266.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2538979
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-93450
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-93450
  • article
    https://github.com/go-openapi/swag
  • article
    https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68
  • article
    https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214
  • article
    https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e
  • article
    https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28
  • article
    https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553580
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100347
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100347
  • article
    https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3
  • article
    https://github.com/getkin/kin-openapi/releases/tag/v0.145.0
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553571
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100348
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100348
  • article
    https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553589
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100349
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100349
  • article
    https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459
  • article
    https://github.com/getkin/kin-openapi/releases/tag/v0.146.0
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553587