RHSA-2026:34342CriticalCVSS 9.8

Red Hat Security Advisory: Cluster Observability Operator 1.5.0

Published
July 1, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (41)

CVE-2025-22868 →CVE-2026-4867 →CVE-2026-25681 →CVE-2026-29063 →CVE-2026-33894 →CVE-2025-22872 →CVE-2025-47911 →CVE-2026-6321 →CVE-2026-33671 →CVE-2026-33895 →CVE-2024-4068 →CVE-2026-33814 →CVE-2026-39821 →CVE-2021-33623 →CVE-2024-52011 →CVE-2026-1526 →CVE-2026-6322 →CVE-2026-12151 →CVE-2026-33896 →CVE-2026-48779 →CVE-2020-7753 →CVE-2024-45338 →CVE-2026-2229 →CVE-2026-6734 →CVE-2026-12143 →CVE-2026-33939 →CVE-2026-33941 →CVE-2025-22870 →CVE-2026-1528 →CVE-2026-9277 →CVE-2026-9697 →CVE-2026-32141 →CVE-2025-58190 →CVE-2026-4800 →CVE-2026-25680 →CVE-2026-33938 →CVE-2026-33228 →CVE-2026-33891 →CVE-2026-33937 →CVE-2026-33940 →CVE-2026-42506 →

📋 Description

CVE-2020-7753 — nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function CVE-2021-33623 — nodejs-trim-newlines: ReDoS in .end() method CVE-2024-4068 — braces: fails to limit the number of characters it can handle CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2024-52011 — launch-editor: vite: launch-editor: Arbitrary command execution via insufficient file argument sanitization CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22870 — golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net CVE-2025-22872 — golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net CVE-2025-47911 — golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html CVE-2025-58190 — golang.org/x/net/html: Infinite parsing loop in golang.org/x/net CVE-2026-1526 — undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression CVE-2026-1528 — undici: undici: Denial of Service via crafted WebSocket frame with large length CVE-2026-2229 — undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-4867 — path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters CVE-2026-6321 — fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies CVE-2026-6322 — fast-uri: fast-uri: URI authority bypass due to improper delimiter handling CVE-2026-6734 — undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-9697 — undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-12151 — undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames CVE-2026-25680 — golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-32141 — flatted: flatted: Unbounded recursion DoS in parse() revive phase CVE-2026-33228 — flatted: Flatted: Prototype pollution vulnerability allows arbitrary code execution via crafted JSON. CVE-2026-33671 — picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-33891 — node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() CVE-2026-33894 — node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification CVE-2026-33895 — node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures CVE-2026-33896 — node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance CVE-2026-33937 — handlebars.js: Handlebars: Remote Code Execution via crafted Abstract Syntax Tree object in compile() CVE-2026-33938 — handlebars: Handlebars: Arbitrary code execution via @partial-block overwrite CVE-2026-33939 — handlebars.js: Handlebars.js: Denial of Service via malformed decorator syntax in template compilation CVE-2026-33940 — handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context CVE-2026-33941 — handlebars.js: Handlebars: Arbitrary code execution via CLI precompiler input sanitization flaw CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-42506 — golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing CVE-2026-48779 — ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments

🎯 Affected products98

  • Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:09b51e95318e4d2e9def285dad6ae8f8688a7b23fe7f80e465748002ffd7d84d_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:86a5f4af2ca39be157aeb8ed19b0490e7626c643f64cf023e51fba79f1ec465d_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:dde7d5a96cc71ff36a520a0718629a2787f743dabd55e0f11fb450c3d18bd490_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:e2684500d9e5164d9a2f5a8accf70f848ae11195de5ddef7d4e9dfa65cc79cb0_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:6eb7997104e5c20e2aeeadfe6028c94bf9a9fff37e0e8dce43779f2171ff3f51_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:6f0412c1c98dc1e062da46853088ae28bee83cf767c320e2c59a9d938c9cb0cf_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:8242946d7b196b879980955ab0bf0586722b17f6ee9ad1d2ac3ef34e1cb05534_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:f75a578c714223ec9e6aad31b53522f313fc22cc6a8028c447bd60a5046bd2ff_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:6578f6e0bf83cf924d724dd110abca715f6fd656477c1bf033cf9707650a0279_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:2e6c7b4aaeda812c292c428188bd3046fdef84dedfa39006bcc7ab525f3330af_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:34a057b1cb67a1de2dbf18cbb1abbb006a3636894d727e400689339ccdf90651_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:764dc2c081add10807008c2467337574e3f6f25d7df6bfe4363df02948cb6d56_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:f5a392c6fb3e138dcf4d7cbc9ef17be3fbd1c41793cc7127567fa2d862a9734e_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:0ee1e15691afd9afb73a0e22065eb14b754890c489be082ec5eb2c970bfb29ac_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:3b05276701190318cb96f1a940b35004fe69b838b3452aae1191a006e57b9cdc_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:e9270444965f2c39ff75323266114ced56fe70c14d9003d5c8b80b70abf4cf0c_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:f3e2613586e616efb8d3ffc5a8200fe2be037c83d2e46423970d55b3f845f1c9_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:2458650c46b90645dc9c0f271598baca1cf7aed76a63be523805eb654ddaab54_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:34199b2ae39fa33693ce3238e7deeb0cbc9b085653e2a7fb3f481a1e39335266_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:837687753bd65fdc8f0815bb6d89cfbfe17332f74eebd11dba8d7cf7dc51b9e1_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:b7534e4963d4d86a4f0f08632b5ecc81f6007bd4488f979bdcb0447228e0cb43_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:573e6cefdacb285de4645b9f7bca37a36ea514d8d6febb3859d60d998a30f6b7_s390x as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:eff791b250e3685d378aaf60356fea32de1ea1789497578b68636f0cb623bb4b_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f0e31451ef147785006a3836e065ef052aa5fc213645482a88b5c8f22b7579c1_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f1873fa1a11acb3698b2fdee4d3e76ea0d86bf42ad03d81fc6dad80d47a0bcfc_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:0b22c50437d7d84f23314479085867643fed1ebcbfc380a7790c4cc607ff6d50_ppc64le as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:258678fae42e66186adec5518e7ec1cea75f3d8d39a8f8ec07fd741938de6bc2_amd64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:9227f20c6a4f81d5e8e8ea938bb978f742470f2ada7fbdaa218ef6dfa755f8f4_arm64 as a component of Cluster Observability Operator 1.5.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:c48e09ca60267fc0189b87414bf5454461846d57adc957683524e392f1fb8d18_s390x as a component of Cluster Observability Operator 1.5.0
  • +68 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: To mitigate this issue, applications using `path-to-regexp` can implement custom regular expressions for parameters beyond the first in a single URL segment. For example, a route like `/:a-:b-:c` can be rewritten as `/:a-:b([^-/]+)-:c([^-/]+)`. Alternatively, limiting the maximum length of incoming URLs can also reduce the risk of exploitation. These changes require application-level configuration and may necessitate a service restart to take effect. Workaround: The single most impactful mitigation is applying network egress controls to restrict which external destinations affected applications can reach. Because the vulnerability causes requests to be misrouted to wrong origins, limiting the set of reachable origins directly reduces the attack surface. These controls collectively limit the blast radius of the connection pool misrouting — the attacker must compromise one of the explicitly allowed destinations rather than any arbitrary origin — but they do not fix the underlying logic bug. Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: Update affected Go applications to use golang.org/x/net version 0.55.0 or later. As a workaround, do not use golang.org/x/net/html to parse untrusted HTML content, or enforce timeouts on HTML parsing operations. Applications that do not parse arbitrary HTML are not affected. Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: To mitigate this issue, applications using Picomatch should avoid passing untrusted glob patterns for compilation or matching. Implementations can disable extglob support for untrusted patterns by setting `noextglob: true` in Picomatch configurations. Alternatively, reject or sanitize patterns containing nested extglobs or specific extglob quantifiers like `+()` and `*()`. Enforcing strict allowlists for accepted pattern syntax can also reduce exposure. If the application is a service, consider running the matching process in an isolated worker or separate process with time and resource limits, and apply application-level request throttling and input validation for any endpoint that accepts glob patterns. No service restart or reload is typically required for these application-level configuration changes, but verify the specific application's behavior. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, ensure that any input provided to the `Handlebars.compile()` function is strictly validated to be a string type, preventing the injection of crafted Abstract Syntax Tree (AST) objects. Additionally, for deployments where templates are pre-compiled at build time, consider utilizing the Handlebars runtime-only build (`handlebars/runtime`). This build variant does not include the `compile()` function, thereby eliminating the attack vector. If the application is a service, a restart may be required for the changes to take effect. Workaround: Applications using Handlebars should implement the runtime-only build (`require('handlebars/runtime')`) to prevent exploitation, as this build lacks the vulnerable `compile()` method. Additionally, review all registered helpers to ensure they do not write arbitrary values to context objects, and avoid using third-party helpers in contexts exposed to untrusted input. Workaround: To mitigate this issue, applications utilizing Handlebars.js should implement robust error handling during template compilation and rendering. Specifically, wrap template compilation and rendering calls in `try/catch` blocks to gracefully handle `TypeError` exceptions. Alternatively, validate user-supplied template input to reject decorator syntax (`{{*...}}`) if decorators are not actively used by the application. Employing a pre-compilation workflow, where templates are compiled at build time and only pre-compiled templates are served, can also prevent runtime exploitation. If the application is a service, a restart may be required for changes to take effect. Workaround: To mitigate this issue, use the runtime-only build of Handlebars.js, which prevents the fallback compilation path from being reached. Alternatively, sanitize all context data before rendering to ensure no non-primitive objects are passed to dynamic partials. Avoid dynamic partial lookups (`{{> (lookup ...)}}`) when context data is user-controlled. Implementing these mitigations may require application-level changes. Workaround: To mitigate this issue, ensure all inputs to the Handlebars CLI precompiler are thoroughly validated, rejecting characters with JavaScript string-escaping significance (e.g., \" , \' , ;). For automated build pipelines, configure a fixed and trusted namespace string via a configuration file rather than passing it through command-line arguments. Additionally, consider running the precompiler within a sandboxed environment, such as a container with restricted write access, to limit the potential impact of successful exploitation. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Update affected Go applications to use golang.org/x/net version 0.55.0 or later. As a workaround, do not use golang.org/x/net/html to parse and re-render untrusted HTML content. Applications that do not parse arbitrary HTML are not affected.

🔗 References (46)