Skip to content
OpenAdvisories
High RHSA-2026:90388 11 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.13-0.4.hum1

Vulnerabilities 11

  • High 7.5
    CVE-2026-100352

    kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote u…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100353

    kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote cl…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100354

    kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document va…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-111181

    body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

    body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding suc…

    body-parser body-parser langfuse-3-worker kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  • Medium 6.9
    CVE-2026-65627

    Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

    Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip…

    potatosalad jose rabbitmq-server jose Debian Ubuntu Azure Linux Hex
  • Medium 6.5
    CVE-2026-16491

    CVE-2026-16491 CVE Record

    Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of ever…

    Grafana Grafana OSS Grafana Enterprise grafana-13.0 Web / CMS Wolfi
  • Medium 6.1
    CVE-2026-110306

    fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before val…

    fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm
  • Medium 5.3
    CVE-2026-110816

    qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

    ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or a null-pr…

    ljharb qs renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • Medium 4.8
    CVE-2026-110180

    fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the W…

    fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm
  • Low 3.7
    CVE-2026-110095

    fast-uri vulnerable to improper path equivalence in relative reference normalization

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relat…

    fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm
  • Low 3.7
    CVE-2026-110725

    fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to…

    fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-100352
  • report
    https://access.redhat.com/security/cve/CVE-2026-100353
  • report
    https://access.redhat.com/security/cve/CVE-2026-100354
  • report
    https://access.redhat.com/security/cve/CVE-2026-110816
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-65627
  • report
    https://access.redhat.com/security/cve/CVE-2026-16491
  • report
    https://access.redhat.com/security/cve/CVE-2026-111181
  • report
    https://access.redhat.com/security/cve/CVE-2026-110306
  • report
    https://access.redhat.com/security/cve/CVE-2026-110180
  • report
    https://access.redhat.com/security/cve/CVE-2026-110095
  • report
    https://access.redhat.com/security/cve/CVE-2026-110725
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_90388.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2562266
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-16491
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-16491
  • article
    https://grafana.com/security/security-advisories/cve-2026-16491
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2561063
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65627
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65627
  • article
    https://cna.erlef.org/cves/CVE-2026-65627.html
  • article
    https://github.com/potatosalad/erlang-jose/commit/857eb8e7f2d33e2c9ca2189e77226561cacaf2ad
  • article
    https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429
  • article
    https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-wfpv-qxp8-x5gm
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-65627
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553588
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100352
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100352
  • article
    https://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e
  • article
    https://github.com/getkin/kin-openapi/releases/tag/v0.148.0
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553592
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100353
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100353
  • article
    https://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9
  • article
    https://github.com/getkin/kin-openapi/releases/tag/v0.149.0
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppw
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553590