RHSA-2026:41929HighCVSS 7.5

Red Hat Security Advisory: Red Hat Developer Hub 1.9.7 release.

Published
July 20, 2026
Last Modified
September 14, 2026

🔗 CVE IDs covered (8)

CVE-2026-12143 →CVE-2026-12151 →CVE-2026-13676 →CVE-2026-42504 →CVE-2026-44902 →CVE-2026-45740 →CVE-2026-6734 →CVE-2026-9697 →

📋 Description

CVE-2026-6734 — undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing CVE-2026-9697 — undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-12151 — undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames CVE-2026-13676 — fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization CVE-2026-42504 — mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-44902 — opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request CVE-2026-45740 — protobufjs: protobufjs: Denial of Service via crafted JSON descriptors

🎯 Affected products4

  • Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:923a9219b3efa5535b7f0b5aec597f04d66c2edb9a3bea4c70c0273cea5be382_amd64 as a component of Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:c26504289ade9a1e816d18cd94af9b6a47fb7ffe66185679d0527376fb505486_amd64 as a component of Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:b1ee0b75525f1873a1ba066102043a8bd28a5867d4d077fefff34444a658e473_amd64 as a component of Red Hat Developer Hub 1.9

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: The single most impactful mitigation is applying network egress controls to restrict which external destinations affected applications can reach. Because the vulnerability causes requests to be misrouted to wrong origins, limiting the set of reachable origins directly reduces the attack surface. These controls collectively limit the blast radius of the connection pool misrouting — the attacker must compromise one of the explicitly allowed destinations rather than any arbitrary origin — but they do not fix the underlying logic bug. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package. Workaround: To mitigate this issue, avoid loading untrusted protobuf JSON descriptors in applications utilizing protobufjs. If untrusted descriptors must be processed, implement validation at an outer boundary to reject excessively nested structures. Alternatively, isolate the descriptor loading process in an environment that can be safely restarted in case of a denial of service.

🔗 References (14)