RHSA-2026:4466HighCVSS 8.3

Red Hat Security Advisory: RHACS 4.8.9 security and bug fix update

Published
March 12, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (10)

CVE-2025-61726 →CVE-2025-66418 →CVE-2025-66471 →CVE-2025-68121 →CVE-2025-13465 →CVE-2025-61728 →CVE-2025-61729 →CVE-2026-21441 →CVE-2026-24040 →CVE-2026-24737 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-24040 — jsPDF: jsPDF: Cross-User Data Leakage via race condition in addJS method CVE-2026-24737 — jsPDF: jsPDF: Arbitrary code execution via unsanitized input in Acroform module

🎯 Affected products46

  • Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:1197ddbba898fab012bba65029328ca7e89601bd9bd600e86ac705d1d770faa6_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:130d7a867a403ec4e78ebb51b31b70de999869f40a08af796b6c03d4b2ab2d9f_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:92142d9e0c6d4ce7c400225257b5ba65b96ea64963e148725a0ac74b239d90bf_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:e1043190866c846c9a7e36e2ad675a9f1609e6265419f83310a936138686af4a_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:0509b6e806c267ddd92413e8ba9b45769a816d8600f836a28275b0b21a4c3b5b_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:424ebfab2a8e3a792d9d9d06bf59a2b934c0cbfc2c2fe93c52cfe513d0cee68a_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:4d6077ee4537837e30898604c9076db61542ef587b03ba202a9f935c7a4bef9f_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:7238ebfc357b3e7dd1fe2a729d94e6b36aa003bdb928ea446c2d9784f8c4bd97_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:044d47930afa0388faad107510c8edfc20cf58e575fdb6a3052e98748b1f94fb_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:334a3cc1eb9c5716a0ce17ce4555d492e5d6e6176734c7e394e758452b53781f_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:478bec31b52c907ed8d1baa66093349c4a25f762e254ca654089944efb7b1622_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:8fb63895a6cd6cfb65478a1e13c91c51f0e0a3fca4f9485355357fc19fd473ce_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:9bb2d3ff2a97d0c3234e4864fc2d21ff278ce06e725e43c56f43e42bed97dd19_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:07d6c6428acef30f990b6d3df65fbd2c6a6a06992f1e3b1fb7113a8799217f9c_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:405aaacf1f71534e5f0c2dea3c8e5b5e7ef0335eae4b09fcb4ff5bb027c70ab0_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:589da7e7297bfbab5d1ea8c406447c2832a1194528869ef4046acf1a4651e9ae_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:f07600ca1141874684a486a159e47455bb8634863eb7ed23d318c6c95d0ae74b_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:1aac55550194674f6ced2b8289d681fb1bcdcbf9b3a3c8951ded8acba9e51dda_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:48fa9f99b3903a555e473fc6ca2664621433146d94ab567c1cb29ea924e4d282_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:731a9504e9911b105c909b11f69b1023f636f373f404d6c608302111f441e0a5_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:fa055641a506ae97ed9feec2d42b1d0553108cbf5e224e0449ce2d36710ffed9_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:02892ae5abb984a8016cd1e0003a911e88e3f5f2b47928bad6c3ee372aacfe20_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:4d1e7ca4ea99d73c269e96037903680159ca0e2506a03fced43f002914a9623e_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:8081be29ad8f88a4356c0a91febdc4e22e0648139b43ba88830c447217f52027_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:88b81439ec590b7e69f0e54222e8baf495b14ce7e86e61938bd5f3207a8f53d6_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:56a2201a99766b5fa825f11c2d8e7e9a77abd3d7fc4459c931b6f93b4aa648ef_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:756c2c6a79bfb89215dc218ea2cd1cd37ab6aa0cc1673397ec31834fbbfc0885_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:8473237c3df9c8667a3b75f74bcf20a5be41525ad4f207e03f9172ba7d8e5592_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:c78dfef02995bd0ac0acabeaa3d0ba5b4776d5c7c52b296a96b40419428cd5ee_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • +16 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, avoid processing untrusted or unverified PDF documents with applications utilizing the jsPDF library. Ensure that any input provided to jsPDF's AcroForm methods and properties is properly sanitized to prevent the injection of arbitrary PDF objects and JavaScript actions. This operational control reduces the risk of arbitrary JavaScript execution.

🔗 References (14)