RHSA-2026:21338HighCVSS 8.8

Red Hat Security Advisory: Red Hat Developer Hub 1.8.7 release.

Published
May 27, 2026
Last Modified
August 27, 2026

🔗 CVE IDs covered (14)

CVE-2026-32282 →CVE-2026-42035 →CVE-2026-42041 →CVE-2026-42043 →CVE-2026-42044 →CVE-2026-6321 →CVE-2026-32281 →CVE-2026-40895 →CVE-2026-41240 →CVE-2026-41242 →CVE-2026-41674 →CVE-2026-42033 →CVE-2026-42039 →CVE-2026-32280 →

📋 Description

CVE-2026-6321 — fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-41240 — DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization CVE-2026-41242 — protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields CVE-2026-41674 — xmldom: xmldom: Arbitrary XML markup injection CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products4

  • Red Hat Developer Hub 1.8
  • registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:51671ad52a7a212954d04773ac544807db4d1a67f1272d992e8bee8630d0f0c3_amd64 as a component of Red Hat Developer Hub 1.8
  • registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:82074d1783ef678fd9ee24592a40deebdd3a3d8bac65253141aca2a35a8e712d_amd64 as a component of Red Hat Developer Hub 1.8
  • registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:eab7750691c87ec2609983cbccd7476e7e0313d9b30a707b687ea05adf092413_amd64 as a component of Red Hat Developer Hub 1.8

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (34)