Skip to content
OpenAdvisories
High RHSA-2026:98613 4 CVEs

Red Hat Security Advisory: cockpit-image-builder security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.3 cockpit-image-builder 0:110.3-1.el10_3

Vulnerabilities 4

  • High 7.5
    CVE-2023-54404 Rejected

    Zod can exhaust memory while validating oversized constrained collections

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects ex…

    langfuse-3-worker langfuse-3 jitsucom-jitsu-console code-server Wolfi npm
  • High 7.5
    CVE-2026-102276

    brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-102278

    brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-93749

    source-map-js through 1.2.1 Event Loop Denial of Service

    source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking …

    7rulnik source-map-js langfuse-3-worker renovate Debian Ubuntu Azure Linux Wolfi npm

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2538368
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542700
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542707
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2544881
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98613.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-54404
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-54404
  • report
    https://access.redhat.com/security/cve/CVE-2026-93749
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-93749
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-93749
  • article
    https://github.com/7rulnik/source-map-js
  • article
    https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118
  • article
    https://github.com/7rulnik/source-map-js/issues/76
  • article
    https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service
  • report
    https://access.redhat.com/security/cve/CVE-2026-102276
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-102276
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-102276
  • article
    https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc
  • article
    https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c
  • article
    https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc
  • article
    https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3
  • article
    https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p
  • report
    https://access.redhat.com/security/cve/CVE-2026-102278
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-102278
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-102278
  • article
    https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b
  • article
    https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c
  • article
    https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db
  • article
    https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7