Skip to content
OpenAdvisories
High RHSA-2026:94794 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana13.2 0:13.2.4-0.6.hum1

Vulnerabilities 3

  • High 8.7
    CVE-2026-116591

    compress zstd: Panic on two-block frames

    compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768.…

    klauspost compress kubescape zarf Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.9
    CVE-2026-116689

    follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

    follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is repla…

    follow-redirects follow-redirects prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • Low 3.7
    CVE-2026-110910

    qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

    ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `&` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax …

    ljharb qs node-qs node-qs Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-110910
  • report
    https://access.redhat.com/security/cve/CVE-2026-116591
  • report
    https://access.redhat.com/security/cve/CVE-2026-116689
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94794.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2561558
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-110910
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-110910
  • article
    https://github.com/ljharb/qs/commit/234d5051f5071efaa025a7ca9e4d34a56a460a1b
  • article
    https://github.com/ljharb/qs/issues/626
  • article
    https://github.com/ljharb/qs/pull/561
  • article
    https://github.com/ljharb/qs/security/advisories/GHSA-w4cr-vjpx-p82q
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2561461
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-116591
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-116591
  • article
    https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d
  • article
    https://github.com/klauspost/compress/releases/tag/v1.20.2
  • article
    https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2562364
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-116689
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-116689
  • article
    https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8
  • article
    https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2
  • article
    https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p