RHSA-2026:2456HighCVSS 8.7

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.26.0 Release.

Published
February 10, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (14)

CVE-2024-25621 →CVE-2025-15284 →CVE-2025-58183 →CVE-2025-65945 →CVE-2025-66418 →CVE-2025-66471 →CVE-2025-66490 →CVE-2026-21441 →CVE-2025-12816 →CVE-2025-52881 →CVE-2025-61729 →CVE-2025-64756 →CVE-2025-66031 →CVE-2026-22029 →

📋 Description

CVE-2024-25621 — github.com/containerd/containerd: containerd local privilege escalation CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-52881 — runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-64756 — glob: glob: Command Injection Vulnerability via Malicious Filenames CVE-2025-65945 — node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm CVE-2025-66031 — node-forge: node-forge ASN.1 Unbounded Recursion CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-66490 — github.com/traefik/traefik: Traefik Path Normalization Bypass in Router + Middleware Rules CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-22029 — @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects

🎯 Affected products62

  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-rhel9@sha256:60a1c1cf2a755e24203ae76e37c3e1c08f97ae8a1905df3538b31f7d9b543f0f_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-rhel9@sha256:772af8d40b674ce306850d3ecf2b70b39bdceaf9e045a2db9299c0dd8bd5e6b5_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-rhel9@sha256:a85afca6643f11c1e0d3976d5e679cea06d85675a5859e7e08611139f2450520_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-rhel9@sha256:aa1d96a9c1d9dbf2fe077748807de1e047a17a942a87688c269aa60537b5c6d4_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:51c627941a630d042202df9fbb0be4c289c3c2b4047092d350f564ea9815c55e_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:c4339b180ab8f5fc5ea656c6d604ad1342e329557be4fe83f7747e7b30327908_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:e2c1df1a1bc028158873b636f8b0341090b7f5211d74d0143c39b3b1f9d36472_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:eaf02961dff765751f8b0f14dbc928401faa0fa60c0ee0bf340ed814509794fc_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:1a4accefcf3c48a44818e9126cdb893d469c93b2f058ce3cff6195d823d9e6c5_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:8608f41d9887eb5fea9df4b9c273fea3512c3ad492bbf8e542e6369db15be680_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:e0e7e2242127555100372896dee91fb69dd1a2fdbcce8473a1c343fc6b0b838d_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:f818d47a01fd77940943b79133d1c7bf053359c72832e0df61397847af43f6e7_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:65b57a43496e012535680c5f6758bf4e482f0496619c1502b50cb4852723088e_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:7705755155844d580db7d2ce942bb095545f465be7a091bc14598f5ae83c0301_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:998779815c5a7888b80f635b942a7409733a839f4c7253a7b5ff920129f987ea_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:ba7fc29722ef40b1565978c1f578786ccb65752bc82f50b794f3c5ab0c789d2a_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:c72b135ccb51663313a9ed55dc5d46af1fbc2476c0243a523ce531262cb82acf_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:8935901859ad9b07689de3d9ea602adf21bcbd2105cedba83503296230b4adad_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b8ae475ea425efb5d30d2c23cd789ee993ee7e5026ed5c892106512351aee416_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:bc60ec1ad66c342f632d32a64012cae3c4426f54bf08578d60d25a68c31b02cd_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:fd35a91b2542252bcd695cd7d02727e8a1c593f1c9a9ec88da92d5d797b17bc5_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:0f87d0637586a8d1aedb84b266f9781af80f63c1342b3951559aa18343825993_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2efc89cc392a8fdb0d2a493aa7cb0d5a6e3cc5efe19054181befe452f293ea59_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:43368b4815eea7a9b1b6a33b061af43f521810efc1c102df0426796e431d0add_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:454566dfa4c035a67f5e4d5ed19289d1c97f2546ee06ef587aff36b3f2cdadee_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4e83ac026653a09abe7f783844617502298f45d4f12cb46445ad8d27722eed42_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:55e7a74a6e435a77cbdeee2d8d333f830d47c52449a27770310f010c4c4c6dd1_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:6a70faa18a51c05328cba689acd2cef1f248ba4d9f78802f3bdc4aff4183d521_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:819f3c80c8241446239d783d01e9a65e3448427a683dbaa5b91ba859329cdbd2_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • +32 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The system administrator on the host can manually chmod the directories to not have group or world accessible permissions: ``` chmod 700 /var/lib/containerd chmod 700 /run/containerd/io.containerd.grpc.v1.cri chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim ``` An alternative mitigation would be to run containerd in rootless mode. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Potential mitigations for this issue include: * Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective). * Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, avoid using the `glob` command-line interface with the `-c` or `--cmd` option when processing filenames from untrusted sources. If programmatic use of `glob` is necessary, ensure that filenames are thoroughly sanitized before being passed to commands executed with shell interpretation enabled.

🔗 References (18)