Red Hat Product Errata RHSA-2026:48151 - Security Advisory
Issued:
2026-07-29
Updated:
2026-07-29

RHSA-2026:48151 - Security Advisory

Synopsis

Important: Red Hat build of Cryostat security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.

Security Fix(es):

  • netty-handler: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
  • netty-resolver-dns: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)
  • netty-handler: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)
  • io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
  • netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)
  • netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043)
  • netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893)
  • netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
  • io.quarkus/quarkus-vertx-http: Authorization bypass in HTTP path-based policies via encoded characters (CVE-2026-50559)
  • jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
  • jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)
  • eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860)
  • golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)
  • golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)
  • golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828)
  • golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
  • golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)
  • golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
  • golang.org/x/net/html: Cross-Site Scripting allowing arbitrary code execution (CVE-2026-25681)
  • golang.org/x/image/tiff: Denial of Service via crafted PackBits-compressed data (CVE-2026-46599)
  • github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder (CVE-2026-46384)
  • github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration (CVE-2026-46385)
  • net: golang: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
  • mime: golang: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
  • form-data: Form field override via CRLF injection (CVE-2026-12143)
  • ws: Denial of Service via memory exhaustion from small WebSocket fragments (CVE-2026-48779)
  • ws: Uninitialized memory disclosure via websocket.close() with TypedArray (CVE-2026-45736)
  • undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
  • undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
  • undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
  • js-cookie: Cookie attribute manipulation via prototype pollution (CVE-2026-46625)
  • brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
  • protobufjs: Denial of Service via crafted schema (CVE-2026-44290)
  • protobufjs: Data integrity impact due to prototype pollution (CVE-2026-44292)
  • protobufjs: Denial of Service via crafted JSON descriptors (CVE-2026-45740)
  • protobufjs: Arbitrary Code Execution via prototype pollution (CVE-2026-44291)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Cryostat 4 x86_64

Fixes

  • BZ - 2466990 - CVE-2026-6860 eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name
  • BZ - 2467822 - CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
  • BZ - 2477081 - CVE-2026-45740 protobufjs: protobufjs: Denial of Service via crafted JSON descriptors
  • BZ - 2477088 - CVE-2026-44292 protobufjs: protobufjs: Data integrity impact due to prototype pollution
  • BZ - 2477100 - CVE-2026-44290 protobufjs: protobufjs: Denial of Service via crafted schema
  • BZ - 2477111 - CVE-2026-44291 protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution
  • BZ - 2477914 - CVE-2026-45736 ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
  • BZ - 2480680 - CVE-2026-39835 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
  • BZ - 2480681 - CVE-2026-39829 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
  • BZ - 2480684 - CVE-2026-39830 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
  • BZ - 2480687 - CVE-2026-39828 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
  • BZ - 2480689 - CVE-2026-46595 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
  • BZ - 2480757 - CVE-2026-27136 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
  • BZ - 2480761 - CVE-2026-25681 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
  • BZ - 2483473 - CVE-2026-46599 golang.org/x/image/tiff: golang.org/x/image/tiff: Denial of Service via crafted PackBits-compressed data
  • BZ - 2483475 - CVE-2026-46385 github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration
  • BZ - 2483482 - CVE-2026-46384 github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder
  • BZ - 2484204 - CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
  • BZ - 2486959 - CVE-2026-50559 io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters
  • BZ - 2487740 - CVE-2026-46625 js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution
  • BZ - 2488081 - CVE-2026-44249 netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation
  • BZ - 2488383 - CVE-2026-44893 netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message
  • BZ - 2488391 - CVE-2026-45416 netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake
  • BZ - 2488400 - CVE-2026-45674 netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation
  • BZ - 2488429 - CVE-2026-50010 netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass
  • BZ - 2488437 - CVE-2026-48059 netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers
  • BZ - 2488439 - CVE-2026-47691 io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records
  • BZ - 2488442 - CVE-2026-48043 netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak
  • BZ - 2488480 - CVE-2026-12143 form-data: form-data: Form field override via CRLF injection
  • BZ - 2489661 - CVE-2026-48779 ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
  • BZ - 2489980 - CVE-2026-12151 undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames
  • BZ - 2490018 - CVE-2026-9697 undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy
  • BZ - 2490024 - CVE-2026-6734 undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing
  • BZ - 2492010 - CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
  • BZ - 2492015 - CVE-2026-54512 jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
  • BZ - 2494813 - CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

aarch64

cryostat/cryostat-agent-init-rhel9@sha256:a9a7a4aff8961cea3f5a4cd5b3370c5f13105e9461f4fb0de70bcfa7b5facab1
cryostat/cryostat-db-rhel9@sha256:c1d344fddcfb7ff4ca4bc3a2ba88917c918879b8411aef0dc1c252e151e7df5f
cryostat/cryostat-grafana-dashboard-rhel9@sha256:681a38cf4bd5f892dd76e634d754106d55c1dc78ed1a59c6003fd75d8e285101
cryostat/cryostat-openshift-console-plugin-rhel9@sha256:f226753fa98b6492d7fffc0d669d1e003f5146c6214d3cbad96d0e3fd8f03663
cryostat/cryostat-operator-bundle@sha256:f6f18f4a84f0a0381e5d03893d2968050537f7e20b08b61b54e922c4d9359292
cryostat/cryostat-reports-rhel9@sha256:a93361b346844f7ec4108a9658cb5fdd61c8963e90ee15e52fb213b1bb4d01c6
cryostat/cryostat-rhel9@sha256:cb6b42fb943940abf1e5c7c9f6050a7f950066497c89dd1306051697d7d207a6
cryostat/cryostat-rhel9-operator@sha256:bd3419415c6e31e2c5269b371d8097e69cad1ff84cea5b98b4892ffad05a501f
cryostat/cryostat-storage-rhel9@sha256:a6ab21c3097a8268cba87c6eeb1f512454da0c68410031c4160c7d7378920850
cryostat/jfr-datasource-rhel9@sha256:89b841456cfe46bf4d3b6bd32dea131c51241d2b1bd266d408eac78ed79c395a

x86_64

cryostat/cryostat-agent-init-rhel9@sha256:56a21c05b7e6face6abbb05a1165d02640779cda3dc829e21237840e7cbac579
cryostat/cryostat-db-rhel9@sha256:1dadbcd03e36720ff1bccd2fa77cdb7096e94322794f5ad3b8a511d08c0c30d3
cryostat/cryostat-grafana-dashboard-rhel9@sha256:ea227ce33a7d948d284c10f3f590ddfdc5058459a52b87c46ce882ac32a82a0f
cryostat/cryostat-openshift-console-plugin-rhel9@sha256:c8915feceaaf08a0f3a05df8a61f44b8cfca2b23872219828a694cee047252a1
cryostat/cryostat-operator-bundle@sha256:8aba4092e4ca595ee8df8f878754f698059c72d956022a1fe9e123d6ed7a7fa6
cryostat/cryostat-reports-rhel9@sha256:b34a578607642a41719d12a902df7b4549606f37e773f6b20ed047b94c1739fe
cryostat/cryostat-rhel9@sha256:c0b028b465d8e6f3b262659195c01deee13538c1e34a823bffb7624bbb5252fc
cryostat/cryostat-rhel9-operator@sha256:98849e3734fbdeb2252a6d4863f999ebba93155c5c650e42711c76c82b6c6b45
cryostat/cryostat-storage-rhel9@sha256:51b54fe0f6d011cd59eaa810f62d4d8b8dde5c0ebd75684cbc2eac104466c467
cryostat/jfr-datasource-rhel9@sha256:2d9c9f1cd1ff98721ea2ee56e86319bc6bc403f9b444e0fbe802ecb89b589134

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.