Red Hat Product Errata RHSA-2026:86676 - Security Advisory
Issued:
2026-10-21
Updated:
2026-10-21

RHSA-2026:86676 - Security Advisory

Synopsis

Important: Streams for Apache Kafka 3.2.2 release and security update

Type/Severity

Security Advisory: Important

Topic

Streams for Apache Kafka 3.2.2 is now available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency.

This release of Red Hat Streams for Apache Kafka 3.2.2 serves as a replacement for Red Hat Streams for Apache Kafka 3.2.1, and includes security and bug fixes, and enhancements.

Security Fix(es):

  • cruise-control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints (CVE-2026-105949)
  • console-operator: unfiltered Kafka client properties allows SA-token exfiltration via config.providers (CVE-2026-96740)
  • console-operator: cross-namespace KafkaUser Secret exfiltration via confused deputy (CVE-2026-105311)
  • console-operator: tenant-controlled container image on ClusterRole-bound pod enables namespace-to-cluster privilege escalation (CVE-2026-105312)
  • kroxylicious-kms-provider-azure-key-vault-kms: Azure Key Vault SSRF exfiltrates bearer token via untrusted EDEK vaultName (CVE-2026-105941)
  • Netty: TLS hostname verification bypass in Netty 4.2.0 through 4.2.16 (CVE-2026-62243)
  • Netty: SNI routing bypass via fragmented TLS ClientHello causing fallback to default SslContext (CVE-2026-75595)
  • Netty: HTTP request smuggling via Transfer-Encoding in Netty 4.1.133 through 4.1.137 and 4.2.13 through 4.2.17 (CVE-2026-89044)
  • Netty: response desynchronization via HttpServerCodec in Netty 4.2.0 through 4.2.16 (CVE-2026-100666)
  • Netty: fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing (CVE-2026-75596)
  • Netty: cache poisoning and information disclosure via CORS Vary header overwrite (CVE-2026-59903)
  • jackson-databind: uncontrolled URI scheme resolution in Path deserialization (CVE-2026-19032)
  • jackson-databind: omits java.lang.Comparable from DefaultBaseTypeLimitingValidator unsafe base types (CVE-2026-83557)
  • jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service (CVE-2026-68497)
  • jackson-databind: unbounded growth of the type ID cache in TypeDeserializerBase retains every unknown raw type ID (CVE-2026-91776)
  • jackson-databind: quadratic forward-reference completion in Collection and Map deserializers (CVE-2026-91777)
  • jackson-core: denial of service via incomplete fix in async JSON parser (CVE-2026-68494)
  • jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS (CVE-2026-89407)
  • jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth (CVE-2026-89425)
  • lz4-java: JVM crash via null byte array in streaming XXHash JNI (CVE-2026-59949)
  • zstd-jni: out-of-bounds read via ZstdDictCompress (CVE-2026-87795)
  • zstd-jni: out-of-bounds read via direct ByteBuffer frame-size methods (CVE-2026-87823)
  • zstd-jni: out-of-bounds read via Zstd.trainFromBufferDirect (CVE-2026-87824)
  • zstd-jni: use-after-free of compression and decompression dictionaries (CVE-2026-87825)
  • zstd-jni: use-after-free via setters called after close() (CVE-2026-87877)
  • zstd-jni: denial of service via negative length (CVE-2026-89045)
  • zstd-jni: out-of-bounds read via negative offset (CVE-2026-89046)
  • zstd-jni: out-of-bounds read via ZstdDictDecompress (CVE-2026-90560)
  • zstd-jni: use-after-free in ZstdCompressCtx.loadDict (CVE-2026-90852)
  • Micrometer: instrumentation of Apache HttpAsyncClient denial of service (CVE-2026-59295)
  • postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)
  • Micrometer: StatsD and logging meter registries line-protocol and log injection (CVE-2026-59296)
  • golang net/url: denial of service from quadratic complexity in path resolution (CVE-2026-56860)
  • Go: denial of service via XML decoding recursion depth issue (CVE-2026-56859)
  • Go net/http: unencrypted HTTP/2 connections vulnerable to denial of service (CVE-2026-56853)
  • Go crypto/tls: denial of service via indefinite KeyUpdate messages (CVE-2026-56862)
  • Go encoding/asn1: denial of service via excessive recursion in Unmarshal (CVE-2026-33818)
  • Go HTTP/2: denial of service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat JBoss Middleware 1 x86_64

Fixes

  • BZ - 2467815 - CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
  • BZ - 2507595 - CVE-2026-45623 postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
  • BZ - 2510733 - CVE-2026-59949 lz4-java: lz4-java: Denial of Service via insufficient validation in XXHash JNI implementations
  • BZ - 2510863 - CVE-2026-105312 console-operator: Streams for Apache Kafka Console: tenant-controlled container image on ClusterRole-bound pod enables namespace-to-cluster privilege escalation
  • BZ - 2510875 - CVE-2026-105311 console-operator: Streams for Apache Kafka Console: cross-namespace KafkaUser Secret exfiltration via confused deputy
  • BZ - 2510876 - CVE-2026-105941 kroxylicious-kms-provider-azure-key-vault-kms: Streams for Apache Kafka Kroxylicious: Azure Key Vault SSRF exfiltrates bearer token via untrusted EDEK vaultName
  • BZ - 2510878 - CVE-2026-105949 cruise-control: Streams for Apache Kafka Cruise Control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
  • BZ - 2511026 - CVE-2026-68494 com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
  • BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
  • BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
  • BZ - 2515827 - CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
  • BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
  • BZ - 2515840 - CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
  • BZ - 2517538 - CVE-2026-59903 io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite
  • BZ - 2520949 - CVE-2026-59296 io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing
  • BZ - 2521309 - CVE-2026-62243 io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration
  • BZ - 2521797 - CVE-2026-59295 io.micrometer/micrometer-core: Micrometer Instrumentation for Apache HttpAsyncClient: Denial of Service via asynchronous request failures
  • BZ - 2526636 - CVE-2026-19032 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization
  • BZ - 2526847 - CVE-2026-83557 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation
  • BZ - 2530661 - CVE-2026-87795 com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service
  • BZ - 2530998 - CVE-2026-87824 com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect
  • BZ - 2531003 - CVE-2026-87877 com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service
  • BZ - 2531004 - CVE-2026-87823 com.github.luben/zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read
  • BZ - 2531007 - CVE-2026-87825 com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability
  • BZ - 2531570 - CVE-2026-89045 com.github.luben/zstd-jni: zstd-jni: Denial of Service via negative length parameter
  • BZ - 2531577 - CVE-2026-89046 zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read
  • BZ - 2531964 - CVE-2026-68497 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing
  • BZ - 2532604 - CVE-2026-90560 com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress
  • BZ - 2533566 - CVE-2026-90852 com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing
  • BZ - 2538720 - CVE-2026-89407 com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking
  • BZ - 2539083 - CVE-2026-91776 jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase
  • BZ - 2539084 - CVE-2026-89425 com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing
  • BZ - 2539085 - CVE-2026-91777 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion
  • BZ - 2539427 - CVE-2026-96740 streamshub/console: console-operator: Streams for Apache Kafka Console: Unfiltered Kafka client properties ? SA-token exfiltration via config.providers
  • BZ - 2541907 - CVE-2026-100666 io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.