Red Hat Product Errata RHSA-2026:68333 - Security Advisory
Issued:
2026-09-16
Updated:
2026-09-16

RHSA-2026:68333 - Security Advisory

Synopsis

Important: Red Hat build of Cryostat security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.

Security Fix(es):

  • Apache HttpComponents Core: Denial of Service via excessive HTTP headers (CVE-2026-54399)
  • Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks (CVE-2026-54428)
  • Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects (CVE-2026-15075)
  • Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation (CVE-2026-15076)
  • SeaweedFS: Information disclosure via S3 API gateway path traversal (CVE-2026-55874)
  • SeaweedFS: Unauthorized data deletion via path traversal in S3 gateway (CVE-2026-58372)
  • protobufjs: Denial of Service via crafted .proto schema (CVE-2026-59877)
  • Quarkus REST: Unbounded multipart MIME part-header accumulation allows remote OOM denial of service (CVE-2026-16308)
  • Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833)
  • Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831)
  • Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message (CVE-2026-55851)
  • Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec (CVE-2026-56745)
  • Netty: Security control bypass allows unauthorized requests via null origin header (CVE-2026-56746)
  • Netty: Denial of Service via HTTP/2 DATA frame memory leak (CVE-2026-56819)
  • Netty: Memory exhaustion in netty-codec-http (decompression bomb) (CVE-2026-59899)
  • Apache Thrift: Denial of Service via integer overflow or wraparound (CVE-2026-55969)
  • Apache Thrift: Denial of Service via improper handling of highly compressed data (CVE-2026-48586)
  • Apache Thrift: Denial of Service due to uncontrolled resource allocation (CVE-2026-45112)
  • brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVE-2026-69152)
  • ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)
  • jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
  • DOMPurify: Cross-site scripting vulnerability allows code execution (CVE-2026-49978)
  • OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
  • Go net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  • Go encoding/xml: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
  • Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
  • Go crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
  • Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  • js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869)
  • golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions (CVE-2026-56854)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Cryostat 4 x86_64

Fixes

  • BZ - 2484830 - CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers
  • BZ - 2495031 - CVE-2026-58372 github.com/seaweedfs/seaweedfs: SeaweedFS: Unauthorized data deletion via path traversal in S3 gateway
  • BZ - 2496101 - CVE-2026-54399 org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers
  • BZ - 2496106 - CVE-2026-54428 org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks
  • BZ - 2498092 - CVE-2026-55874 SeaweedFS: github.com/seaweedfs/seaweedfs: SeaweedFS: Information disclosure via S3 API gateway path traversal
  • BZ - 2498122 - CVE-2026-59869 js-yaml: js-yaml: Denial of Service via crafted YAML documents
  • BZ - 2498127 - CVE-2026-59877 protobufjs: protobufjs: Denial of Service via crafted .proto schema
  • BZ - 2499914 - CVE-2026-15076 io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation
  • BZ - 2499919 - CVE-2026-15075 vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects
  • BZ - 2500695 - CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
  • BZ - 2503101 - CVE-2026-55833 netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification
  • BZ - 2503103 - CVE-2026-55831 io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing
  • BZ - 2505422 - CVE-2026-56746 io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header
  • BZ - 2505698 - CVE-2026-55851 io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message
  • BZ - 2505911 - CVE-2026-56745 netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec
  • BZ - 2505980 - CVE-2026-56819 io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak
  • BZ - 2506373 - CVE-2026-16308 io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service
  • BZ - 2507433 - CVE-2026-55969 thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound
  • BZ - 2507434 - CVE-2026-48586 thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data
  • BZ - 2507439 - CVE-2026-45112 thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation
  • BZ - 2507482 - CVE-2026-59899 io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)
  • BZ - 2510722 - CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
  • BZ - 2510801 - CVE-2026-69192 ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass
  • BZ - 2511026 - CVE-2026-68494 com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
  • BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
  • BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
  • BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
  • BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
  • BZ - 2515840 - CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
  • BZ - 2525639 - CVE-2026-56854 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions

aarch64

cryostat/cryostat-agent-init-rhel9@sha256:bc47200b2bb00c9cb4f4ae4929d0faca3b7685ba160bafe07f773e8cfe977b6e
cryostat/cryostat-db-rhel9@sha256:0bcd6d1e5fd1dc893c83641c96ebcdaf27fd576cd150d7c53a79ec99cd0581be
cryostat/cryostat-grafana-dashboard-rhel9@sha256:8d67c1c76672ecb9241469355656c751bd8b54c138d6fb16866d604bb6da95ed
cryostat/cryostat-openshift-console-plugin-rhel9@sha256:a1c2dfa85f82dd2bd96853270cd46de8dcffe4f6f81e7646eeb032843884ff94
cryostat/cryostat-operator-bundle@sha256:01b7df9a63ddcffaca5f4594da01b1d0cb03fb4c0db8061266a67f027a67393b
cryostat/cryostat-reports-rhel9@sha256:56942fe083a729c20c316899678a9b8bcb53d7cd0166bf1d026e71e7d69aee86
cryostat/cryostat-rhel9@sha256:4d1c6cfbce9d2a106ff1d14681fdc51d00b203f057d66e5023067b04d3429d20
cryostat/cryostat-rhel9-operator@sha256:a6932f33459645777f557163dd24c2d7dfd11bda6020d7dc144c65eda80a178e
cryostat/cryostat-storage-rhel9@sha256:66f8afe0cebac9600554636ec0493a15634e6af6e94875b65bbdfb39ae92b4b3
cryostat/jfr-datasource-rhel9@sha256:23ea9da4ea97cdd04d95b500fbca8edd7db908fec16043ae1fa336634ffcd1fb

x86_64

cryostat/cryostat-agent-init-rhel9@sha256:fd21840bc7fd04a3387186e8eadf3c1772b71c3a68d90c6f8f157de0c1e51826
cryostat/cryostat-db-rhel9@sha256:a1c62ba6ab13ab0b429552304050235f5d85870de0d5733bf4bf9240661e769d
cryostat/cryostat-grafana-dashboard-rhel9@sha256:a236a3646adf4c5b467e630cdd7b8ae4b5d874dc6342fcac1e5290c2beac0d06
cryostat/cryostat-openshift-console-plugin-rhel9@sha256:11bda199b4124dd05b55b07b4d7508b1029371ad650afc3bba12b486011c6b26
cryostat/cryostat-operator-bundle@sha256:1ff5e21e25d3c96ed212689f2b368b20a935f0669af31c37a1ae90cdf6be9d9e
cryostat/cryostat-reports-rhel9@sha256:09183b020f24f1b478b3391109f5b42aa066f9df71febec4c642621f82d3a304
cryostat/cryostat-rhel9@sha256:1bbd4a394a3ebcff86b518ec7a7d242088913052873b73cc2d7e09ed1b181c80
cryostat/cryostat-rhel9-operator@sha256:5091ea57743ec205834299edc38fc4bd011c7eb735bda422dc751a5084bb43af
cryostat/cryostat-storage-rhel9@sha256:5be66a00286e1733b91ea407788843a4123ff8bdcb830ec031bcd41b1e337255
cryostat/jfr-datasource-rhel9@sha256:2663c6efa60f097f5b0be4a15f58bf1645b3313d1ebab6c19c42b8e6cc3e234a

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.