RHSA-2026:21772HighCVSS 8.8

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.28.0 Release.

Published
May 28, 2026
Last Modified
September 3, 2026

🔗 CVE IDs covered (39)

CVE-2025-68121 →CVE-2026-1528 →CVE-2026-1605 →CVE-2026-2229 →CVE-2026-29074 →CVE-2026-40477 →CVE-2026-40972 →CVE-2026-42033 →CVE-2026-33252 →CVE-2026-40478 →CVE-2026-42043 →CVE-2025-14813 →CVE-2026-0636 →CVE-2026-1525 →CVE-2026-27904 →CVE-2026-32280 →CVE-2026-26996 →CVE-2026-32141 →CVE-2026-32282 →CVE-2026-39858 →CVE-2026-40611 →CVE-2026-40975 →CVE-2026-33810 →CVE-2026-34742 →CVE-2026-35051 →CVE-2026-42035 →CVE-2026-42041 →CVE-2026-31802 →CVE-2026-32305 →CVE-2026-40895 →CVE-2026-40973 →CVE-2026-1526 →CVE-2026-30827 →CVE-2026-40912 →CVE-2026-42039 →CVE-2026-42044 →CVE-2026-2327 →CVE-2026-5588 →CVE-2026-41240 →

📋 Description

CVE-2025-14813 — bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-0636 — bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java CVE-2026-1525 — undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers CVE-2026-1526 — undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression CVE-2026-1528 — undici: undici: Denial of Service via crafted WebSocket frame with large length CVE-2026-1605 — org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests CVE-2026-2229 — undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter CVE-2026-2327 — markdown-it: markdown-it: Denial of Service via Regular Expression Denial of Service in linkify function CVE-2026-5588 — bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-27904 — minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions CVE-2026-29074 — svgo: SVGO: Denial of Service via XML entity expansion CVE-2026-30827 — express-rate-limit: express-rate-limit: Denial of Service for IPv4 clients due to incorrect IPv6 subnet masking CVE-2026-31802 — tar: tar: File overwrite via drive-relative symlink traversal CVE-2026-32141 — flatted: flatted: Unbounded recursion DoS in parse() revive phase CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32305 — Traefik: github.com/traefik/traefik: Traefik: mTLS bypass allows unauthorized service access via fragmented ClientHello. CVE-2026-33252 — encoding/json: golang: github.com/modelcontextprotocol/go-sdk: Go MCP SDK: Remote tool execution via cross-site request forgery CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-34742 — github.com/modelcontextprotocol/go-sdk: Model Context Protocol (MCP) Go SDK: DNS rebinding vulnerability allows unauthorized access CVE-2026-35051 — Traefik: github.com/traefik/traefik: Traefik: Authentication bypass in ForwardAuth middleware CVE-2026-39858 — traefik: Traefik: Authentication bypass via unsanitized alias headers CVE-2026-40477 — thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution CVE-2026-40478 — thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass CVE-2026-40611 — github.com/go-acme/lego: Lego: Arbitrary file write and deletion via path traversal from a malicious ACME server CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-40912 — github.com/traefik/traefik: Traefik: Authentication bypass via crafted URL dot-segments in StripPrefixRegex middleware CVE-2026-40972 — Spring Boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison CVE-2026-40973 — Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory CVE-2026-40975 — Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. CVE-2026-41240 — DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products62

  • Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/code-rhel9@sha256:b86a03ffcc1fc359116cc0ca231c64e5d612f047d41b5a2d44d1f3a9d880c14b_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/code-rhel9@sha256:cbe05937b330c830b280fcde70ddc04e76fc01770f519db54385e62d3cdc4365_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/code-rhel9@sha256:cc5228f1a81ab52552eff2f4b4147affa898ffa429a49f7fb47ca394e892c482_s390x as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/code-rhel9@sha256:d752b1a872d03c454c7a2e8a6141fe41df0a62d5e968be7a69f0203fefcb6559_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:1a5fb68c1f62c66f2d62c3b6a3ef48ed902e59307b1a9e50c658132ee870f3cd_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:1d42bcfcf3be9fdb75625eb17ecc7b05d311ceb7e5db9b64a61b957a0dac2017_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:20e1309511f84fb268d23fc50ef0756dfc4fdb917b6647e6b09c24d59439288d_s390x as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:a47056a230633c885e68ec24f4a0827e6ed6e295a16ab03ee7a4ef5ea1064254_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:4805d4c6d4c2d53d3515ad28ac35c6360413bef3dc5399ce328449b16bcac729_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:561ca113c28e37b1753d902d2f42dc698bfcbbc2f2e3eb5e0b4d549fb5593309_s390x as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:64e5a7d8b8ea5d4f4e9248ffe5ff1235897a6fb799e9ae80cc321730c6173b1a_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:ae093c3335e1d3ebc56814a7482cf5783e6bf5bfab536b1e04dd88a74a8260e4_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:0f5532354d096fca2b4b51e1184c5d219d9c51880873482437ddf64c197ceb1f_s390x as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:adea9256b3e9ff929f054325d167c4412c61d2d0e89b5975d751c261a3985414_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:e10099e6dec84dd608b95679315fd09d6a8c377f57dabf68f5b3e1fdb12a10e5_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:fd8259ec2fe8fe72432e32186b2319bc0ef5eb1d25092b66b8f65dda04e783ac_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:aea41739b819bbf8d1bfbb67d82606f651c196fa31e44a55df0c54b9bbaba589_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:0abb9413b448c31440bf42cdd876174b1534043011a68842c95d18baca978b65_s390x as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:32489db0d434bcd83578d77acb7c3e8cbbcb7458ffe47bc003423df9b2437133_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:586e3c00134033b5371c6eb5c839c65c89e7833918122db6ad6de7b286caf2da_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:f53eafc9e43fca96bad5352706b791476164902cf53261437642da9352b9e121_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:c694a1979337f1666efdc017209e7b3a77b9639f823086ce907c166f6120fa71_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:ce0df59b0323f22f213488878123cbce067b946a2ea600e9fc6d26f2ac9ad12e_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d9e4872d43f955438cd3f7bd7bc1498941e6e830ea156781f066fdd8ee892d8e_s390x as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:efd2d59a47a3507c3cdbd8e890c6d9a0c868025659fccc67d3f718253fede591_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:1c79ec491dbdcb2dcd861df09d8cadb3b6db3743b614b65301020f4a2f6d39dd_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:2babef463b6f97f7befd13ea628baae2d4d893cc9f81158ff91d82cca428d801_s390x as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:2d4c066361ac0ba3b0113a03d1b8710d9fe96b666f090853ed9a5bf8bd5aadea_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:d23f8c49b65d7f605c661c01183e2da4fa7ea6c34aa69a9d9b7f552aeb759945_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28
  • +32 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode. Workaround: To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed. Workaround: Restrict network access to applications utilizing the express-rate-limit middleware to trusted clients or networks. Implementing firewall rules or network access controls can prevent untrusted actors from exploiting the shared rate-limit bucket vulnerability affecting IPv4-mapped IPv6 addresses on dual-stack servers. Workaround: To mitigate unauthorized access, restrict network access to the Traefik instance to only trusted clients and networks. Implement firewall rules to limit inbound connections to the ports Traefik listens on for mTLS-protected services. For example, using `firewalld`, specific source IP addresses or networks can be allowed. After applying firewall rules, ensure the firewall service is reloaded for changes to take effect. This reduces the attack surface by preventing untrusted external access to the Traefik instance. Workaround: To mitigate this vulnerability, ensure that deployments utilizing the Go MCP SDK are configured with proper authorization mechanisms. This prevents unauthorized cross-site requests from triggering tool execution. Additionally, restrict network access to the local server running the SDK to trusted sources only, using firewall rules to limit exposure. Workaround: To mitigate this issue, ensure that the `trustForwardHeader` setting in Traefik's ForwardAuth middleware is not explicitly configured as `false` unless absolutely necessary. If Traefik is deployed behind a trusted upstream proxy, review the configuration to ensure that `trustForwardHeader` is either set to `true` or omitted, allowing Traefik to correctly process forwarded headers for authentication. If this configuration is modified, a restart or reload of the Traefik service may be required for the changes to take effect. Workaround: The vulnerability arises when unvalidated user input is directly passed to the Thymeleaf template engine. To mitigate this, application developers should implement robust input validation and sanitization for all user-supplied data before it is processed by the Thymeleaf template engine. This ensures that malicious expressions cannot be executed. Workaround: To mitigate this issue, ensure that the `lego` client only interacts with trusted ACME servers. Additionally, run the `lego` process with the least necessary privileges and in a restricted environment to limit the potential impact of arbitrary file operations. This may involve containerization or specific filesystem access controls. Workaround: To mitigate this issue, disable the Spring Boot DevTools remote functionality in production environments. This feature is primarily intended for development and should not be enabled in publicly accessible deployments. To disable remote DevTools, ensure the `spring.devtools.remote.secret` property is not configured, or explicitly set `spring.devtools.remote.enabled=false` in your application's `application.properties` or `application.yml` file. Example for `application.properties`: `spring.devtools.remote.enabled=false` Disabling this feature may impact development workflows that rely on remote DevTools capabilities. A restart of the application is required for the changes to take effect. Workaround: To mitigate this issue, ensure that the `server.servlet.session.persistent` property is set to `false` in your Spring Boot application's configuration. This prevents session information from being written to the predictable temporary directory, thereby removing the conditions necessary for exploitation. Disabling persistent sessions may affect application behavior that relies on session data surviving restarts. Workaround: Applications utilizing Spring Boot should avoid using the `${random.value}` property for generating cryptographic secrets or other security-sensitive data. Developers should review their application configurations and code to ensure that only cryptographically strong random number generators are used for such purposes. For UUID generation, `${random.uuid}` is not affected and can be used.

🔗 References (43)