RHSA-2026:17789HighCVSS 9.1

Red Hat Security Advisory: Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update

Published
May 26, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (16)

CVE-2026-4800 →CVE-2026-33813 →CVE-2026-4926 →CVE-2026-33870 →CVE-2026-33871 →CVE-2026-33816 →CVE-2026-1002 →CVE-2026-1525 →CVE-2026-1526 →CVE-2026-33186 →CVE-2026-39852 →CVE-2026-40895 →CVE-2026-33815 →CVE-2026-34986 →CVE-2026-1528 →CVE-2026-2229 →

📋 Description

CVE-2026-1002 — io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files CVE-2026-1525 — undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers CVE-2026-1526 — undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression CVE-2026-1528 — undici: undici: Denial of Service via crafted WebSocket frame with large length CVE-2026-2229 — undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-4926 — path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33813 — golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing CVE-2026-33815 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-33816 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-33870 — io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values CVE-2026-33871 — netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-39852 — io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects

🎯 Affected products21

  • Cryostat 4 on RHEL 9
  • cryostat/cryostat-agent-init-rhel9@sha256:05904c67af6e6d63949ea48f330cc3f9c4ce567dcf83b021dfb5360c48f9ae97_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-agent-init-rhel9@sha256:5e162295c4cce6d9def315835bfe671bf88f429a9dfbf1ee26bf1858c4702e5b_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-db-rhel9@sha256:9da420fb6051f62e735fc3b4507cfa4faba5cf983a7d3dceb5fd821c52595f8c_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-db-rhel9@sha256:e6a27d9520ca69341235411b7dfab6366f73311fa0147f345c29a90dcb823d81_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-grafana-dashboard-rhel9@sha256:8270ad1bdb5394e463b8f688fe39adbfd3177881f3a3ed0e188f5acd07b12747_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-grafana-dashboard-rhel9@sha256:ebed34803b5872d40fba925204af828932baba2501dd3cc751802fd2c3c5ef18_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-openshift-console-plugin-rhel9@sha256:a8e549b2557877c4e4ce8c13073f912b4fef397aa820bce20902b405778cd588_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-openshift-console-plugin-rhel9@sha256:d1b918ec986072f9b35182414d9d785bdcf511044e33070d9e665b832e9bdc97_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-operator-bundle@sha256:02939e59fc5fb80eafdb3ccbe30840f5a16c174fc78856dc3ad993e3cbec5ff0_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-operator-bundle@sha256:6c02eb8e3d175bbc9295934f3560652ab0d53d34ad8ebdc6cd573f00ca8fac87_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-reports-rhel9@sha256:2842124c4358b187ff5fb7e82ec20dd0b3c6a177fb604ff1087a5e6e0de5a9d0_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-reports-rhel9@sha256:2d29b9fc42e33af7ec5871fc6753a9922542ab644de5fc661cdd811ce41fc203_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9-operator@sha256:143275d78803237bd4e9c339beda5a861b6e8de6fae0e55a329f983437595610_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9-operator@sha256:b93e4a60ac90f538549f6694d7d016522a325b64731b9c99a2b55a7afac9c1a9_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9@sha256:0cd0765ead8288d987e54791a82bc9d410370daf45649d704f5f4b1b25827e7f_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9@sha256:fdd88ec5966a2deea291c4daaa28552056bf3fb88fa027fec0686b36c114f9c9_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-storage-rhel9@sha256:6efb1b537d52c12b59a02929c57b31ae3ee04cfb1f6c091d0e6967212c71f1fb_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-storage-rhel9@sha256:8c76f05ffe0a2f3dd6b050cd455b48611e4edb16077f0e19dae4be2a52b654c3_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/jfr-datasource-rhel9@sha256:5f6e2740e4ae7211c2a94e89db535d7be39761da38373763f1ea694211cc2c4f_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/jfr-datasource-rhel9@sha256:f6a39d2a84f70d7e817be34f17846a76699aa2d554a7a8f1e2f93079eeba6333_amd64 as a component of Cryostat 4 on RHEL 9

✅ Remediation

You can download the Cryostat 4 on RHEL 9 container images that this update provides from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available in the Red Hat Container Catalog (see the References section). Dockerfiles and scripts should be amended to refer to this new image specifically or to the latest image generally. Workaround: To mitigate this vulnerability, consider disabling the static handler cache by configuring the StaticHandler instance with setCachingEnabled(false), for example: ~~~ StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false); ~~~ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, configure a reverse proxy or load balancer in front of the Quarkus application to normalize incoming URL paths by stripping matrix parameters (semicolons) before requests reach the Quarkus security layer. This ensures that authorization checks are performed on the intended path. Ensure that any changes to proxy configurations are thoroughly tested and services are reloaded or restarted as necessary to apply the new settings.

🔗 References (19)