Red Hat Product Errata RHSA-2026:95360 - Security Advisory
Issued:
2026-11-04
Updated:
2026-11-04

RHSA-2026:95360 - Security Advisory

Synopsis

Important: Red Hat build of Cryostat security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.

Security Fix(es):

  • dompurify: Cross-site scripting vulnerability allows code execution (CVE-2026-49978)
  • immutable-js: Denial of Service due to mishandling of large index values in List operations (CVE-2026-59879)
  • qs: Denial of Service via improper validation in stringify function (CVE-2026-82417)
  • golang.org/x/image/tiff: Denial of Service via invalid TIFF image (CVE-2026-46604)
  • golang.org/x/image/vp8l: Denial of Service via excessive memory allocation (CVE-2026-46603)
  • github.com/apache/thrift: Denial of Service via unbounded recursion in Go transports (CVE-2026-83663)
  • github.com/apache/thrift: Denial of Service via improper handling of compressed data (CVE-2026-94637)
  • github.com/apache/thrift: Arbitrary code execution via heap-based buffer overflow during frame compression (CVE-2026-91135)
  • golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write (CVE-2026-39834)
  • Golang html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
  • Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
  • Golang encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  • Golang net/http: golang.org/x/net/http2: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • go.mongodb.org/mongo-driver: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs (CVE-2026-88031)
  • google.golang.org/grpc: Denial of Service via malformed RPC requests (CVE-2026-84445)
  • brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet (CVE-2026-90711)
  • handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) (CVE-2026-106446)
  • handlebars: JavaScript Injection via Own Property Check Bypass (CVE-2026-106445)
  • brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Cryostat 4 x86_64

Fixes

  • BZ - 2480676 - CVE-2026-39834 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
  • BZ - 2493766 - CVE-2026-46604 golang.org/x/image/tiff: golang.org/x/image/tiff: Denial of Service via invalid TIFF image
  • BZ - 2498158 - CVE-2026-59879 immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations
  • BZ - 2500695 - CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
  • BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
  • BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
  • BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
  • BZ - 2525936 - CVE-2026-82417 qs: qs: Denial of Service via improper validation in stringify function
  • BZ - 2531587 - CVE-2026-88031 go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs
  • BZ - 2533175 - CVE-2026-84445 google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests
  • BZ - 2533602 - CVE-2026-90711 proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
  • BZ - 2542700 - CVE-2026-102278 brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns
  • BZ - 2542707 - CVE-2026-102276 brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns
  • BZ - 2545013 - CVE-2026-91135 thrift: Apache Thrift: Arbitrary code execution via heap-based buffer overflow during frame compression
  • BZ - 2545152 - CVE-2026-94637 github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of compressed data
  • BZ - 2545170 - CVE-2026-83663 github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports
  • BZ - 2547112 - CVE-2026-106445 handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass
  • BZ - 2547120 - CVE-2026-106446 handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
  • BZ - 2548344 - CVE-2026-78669 net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames

CVEs

aarch64

cryostat/cryostat-agent-init-rhel9@sha256:dd5223d7e14825ce9a763e5897c590d81ad7628d39d5df32a83525eed4a7eaaf
cryostat/cryostat-db-rhel9@sha256:f55f9d56d92278721078e2e30fb2bbb6fe37c13ef7ba889e97c52fb7cf7e305d
cryostat/cryostat-grafana-dashboard-rhel9@sha256:72044555bcb7c9f99fccb9295216358eedbd35cb1af93619a23def2f8781e21f
cryostat/cryostat-openshift-console-plugin-rhel9@sha256:cc675e69e1dd2824967a36391a252a1eba48a7d40a0e7147cc000925d6ff15b2
cryostat/cryostat-operator-bundle@sha256:5cc69c73aec0b1bf41c5463bb301c3c8ca3e92a6692f1c3033dab457d540541f
cryostat/cryostat-reports-rhel9@sha256:7ba11260b30778522542660ae262a22d5aac59a34c8c29286ead4535720652cc
cryostat/cryostat-rhel9@sha256:83a69191d356f8f87b5bd2e13a2e091f083b61ed6ed08a1f67c0f54426654c3e
cryostat/cryostat-rhel9-operator@sha256:1af2938db225959f0672150b999fd6b43f11db48db16651ec395dca304830063
cryostat/cryostat-storage-rhel9@sha256:f694d48d0ce96693e87760c26436c5f60888002aeb4c9cb8276a70cc87aa42f2
cryostat/jfr-datasource-rhel9@sha256:cca5ede1948dcb81597f269b99ccca83a13725e356e04e2007e001c05ddfa567

x86_64

cryostat/cryostat-agent-init-rhel9@sha256:70670befce83fe0b5c952944f3ce605cd28dd2748ee684457ef4ace109ee574b
cryostat/cryostat-db-rhel9@sha256:03cfb6cf1c6f79d972e3e60ec8253e284673429bce9d51e42031efe6c109fc5b
cryostat/cryostat-grafana-dashboard-rhel9@sha256:b4e295b5e8244f1eec07302bbdf180d00939350e2812d43a812482a72a39727d
cryostat/cryostat-openshift-console-plugin-rhel9@sha256:f84432eb24357082edf7a0bbff2cdf196e9ff63200d230a135704156c8529c05
cryostat/cryostat-operator-bundle@sha256:a888454a617e9bc4da0576910e5e427f8402b7c81c1544f42a314bf1336d9c39
cryostat/cryostat-reports-rhel9@sha256:38fbd37ac48a98540273b354294e7ba08fa3cbbf5914a66fb563ed96f53ef681
cryostat/cryostat-rhel9@sha256:e87002a807cb976da35bf8d7fa34983164263228eb633204059edf28846f2b85
cryostat/cryostat-rhel9-operator@sha256:9fd13fcc7d3b038b4afe04fa488e7e9e8dfb23398d445bb5571401eecb1848ef
cryostat/cryostat-storage-rhel9@sha256:f7bfbf90b0dac7cb87324fb22c132d7dce437516be2a46debde536647b907f7b
cryostat/jfr-datasource-rhel9@sha256:c8cf4acf7a6fc1f858e8785dafd5cb3d103f0ed6db49151101d0746001719e6f

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.