RHSA-2026:2844HighCVSS 9.8

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.26.1 Release.

Published
February 17, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (6)

CVE-2025-15467 →CVE-2025-61726 →CVE-2025-61732 →CVE-2026-0719 →CVE-2026-1761 →CVE-2025-6176 →

📋 Description

CVE-2025-6176 — Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS CVE-2025-15467 — openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61732 — cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy CVE-2026-0719 — libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication CVE-2026-1761 — libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response

🎯 Affected products54

  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-rhel9@sha256:07b5aa25be771e9205eeec6b99eba468e856fe613ce1f14f56fe1a1987bebff1_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-rhel9@sha256:080f5c8c0036ff152960bace14a46d838aaab50d005b02741ba26d08fc040249_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-rhel9@sha256:a03a86747f6191a55ba5a95383124c93fcbba2b137da04fe6b9508a2e54a2a86_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-rhel9@sha256:d93b78cc40286233dd48bf7bb91eab892329bb56367c03e4e2cf36e565917209_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:4aff583803de7ebd055aa820c3167cf60fd65c4c5192cb86af65803c552871ec_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:6c0618a262457b1e209870c64225082c01200807b2ae338063425d3aa2f96fcc_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:a9a3ee20941be2f803fc3d5ac9f14ebdc4bea275927f56696aaf9ba8b4900c74_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:e81bba6aea603106046eaf3196d785d1ae63eb82b8b2d5799c2e8757ca30fb4b_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:2dd449320ffd135b13cc7a43392f8be402c6b21677e949b6cb23d90c25b2af27_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:46e17c423ab487e330913b8f7addd7f4625e5f74385104e5856c01f78ef31d09_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:b01aa02ff03139120d3316da77ec4a0b4423c3c5561a3a1113732eedabe9aecd_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:ffdb6bd87cb727dd99df7a9b3c160bd26fc113957bb22dc442cd38ba6b56d485_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:20b0660092b3a3c069c06aae34f3306bcd655d58e33f7b8ce168aa3f21ccfef1_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:48de995db52924f4a20fc4c62c18a62223b3ef05ac5b5008dcb3628a4ee2767e_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:a67220640f3cbaea11bc4e47a36fc852152620bc50a81cdf155c56374b2cc546_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:cfba0a1117e348ee5252289beaca5affdff3dc4a0e4cfc87f7b3ed20db16c1db_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:1da81db973a6033fbe12a59e877335bf194ec4563b61e530a44326915518f788_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:740fb67de0e874261cf456ab601b9c5a2de47912d04375172c36ee2110c54594_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:7ca3cba246b8d1163fcbbb2d4798a27b5e123f36b5155e0c563747316f09b09f_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b151b96c8187c820c6e91e6bc2a3048839e5b3dc883cec69bb04e46a875c6f74_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:c2c57991cc8bdda2882836401980b05d81bb254d8f6002cc345fbb985e43c258_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:0265615072824fe889c5bd3d1f40d8027c38236718ec3c994bc327583e4e4885_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:24e0cccde7ea62cc4371acaa567e3e180c01941fa35844088bc73a4b27e5281e_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:8704addd93ca4fbbf4a585084775de2fe496e7641b1406a426d29e107d86119c_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d198c71d91965b65f49eea8497a7574cb8d7a9599c54fa95d8d8cd12f60c6c81_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:a644a873fe159eece3e6ce341eceb7b7a4fe62f5e835e604aaf8574735d960ca_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:b503ab30512cc9bf3cfa89f5a8b09a591b038f61c22d1b2777477f40bbdbec0b_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:cb7dfb0bcf96a8f8ddeea922aa9be138b734b085267e2ce6a89390a51349f57d_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f13b292f3ab98895a8d07f4b4637af2c8fe0b45dd4609e3a2a2548b9dfb239d1_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • +24 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this issue, applications utilizing libsoup that process HTTP responses should be configured to only communicate with trusted endpoints. Implement network egress filtering to restrict vulnerable applications from connecting to untrusted external services, thereby reducing the exposure to specially crafted multipart HTTP responses.

🔗 References (10)