RHSA-2026:33574HighCVSS 8.7

Red Hat Security Advisory: Red Hat Developer Hub 1.9.6 release.

Published
June 30, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (31)

CVE-2026-47137 →CVE-2026-48779 →CVE-2026-9673 →CVE-2026-33811 →CVE-2026-42338 →CVE-2026-44492 →CVE-2026-9277 →CVE-2026-42039 →CVE-2026-44488 →CVE-2026-44495 →CVE-2026-47139 →CVE-2026-47209 →CVE-2026-44494 →CVE-2026-47135 →CVE-2026-47141 →CVE-2026-39820 →CVE-2026-42033 →CVE-2026-47131 →CVE-2026-42044 →CVE-2026-42499 →CVE-2026-44487 →CVE-2026-44724 →CVE-2026-47140 →CVE-2026-47208 →CVE-2026-27145 →CVE-2026-42035 →CVE-2026-45736 →CVE-2026-42041 →CVE-2026-42043 →CVE-2026-44486 →CVE-2026-44496 →

📋 Description

CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-9673 — json-2-csv: json-2-csv: CSV Injection vulnerability allows arbitrary code execution via preventCsvInjection bypass. CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget CVE-2026-42338 — ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name CVE-2026-44724 — systeminformation: systeminformation: Command injection via NetworkManager connection profile name CVE-2026-45736 — ws: ws: Uninitialized memory disclosure via websocket.close() with TypedArray CVE-2026-47131 — vm2: vm2: Arbitrary code execution via sandbox escape vulnerability CVE-2026-47135 — vm2: vm2: Sandbox escape allows arbitrary code execution on the host system CVE-2026-47137 — vm2: vm2: Sandbox escape leading to arbitrary code execution via security bypass CVE-2026-47139 — vm2: vm2: Sandbox escape via internal HTTP built-ins leading to network restriction bypass CVE-2026-47140 — vm2: vm2: Arbitrary code execution due to incomplete sandbox restrictions CVE-2026-47141 — vm2: vm2: NodeVM observability builtins leak host process and HTTP request data CVE-2026-47208 — vm2: vm2: Sandbox Breakout Using Promise Species CVE-2026-47209 — vm2: vm2: Integrity bypass via incorrect property assignment leading to potential arbitrary code execution CVE-2026-48779 — ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments

🎯 Affected products4

  • Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:044d2d72c21329826c144d9b55c381576a421188139de0fed693e74997665d2c_amd64 as a component of Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:66fb23e8dbced7bb187928fb38562ae9e2649265d56f745044dd5e79b4209893_amd64 as a component of Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:219babfcc89ae903edf35022aae79ba1d1b326386978db8ff267e24e50f9a785_amd64 as a component of Red Hat Developer Hub 1.9

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (71)