RHSA-2026:4467HighCVSS 8.3

Red Hat Security Advisory: RHACS 4.9.4 security and bug fix update

Published
March 12, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (10)

CVE-2026-24737 →CVE-2025-61726 →CVE-2025-61729 →CVE-2025-66471 →CVE-2025-68121 →CVE-2026-21441 →CVE-2026-24040 →CVE-2025-13465 →CVE-2025-61728 →CVE-2025-66418 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-24040 — jsPDF: jsPDF: Cross-User Data Leakage via race condition in addJS method CVE-2026-24737 — jsPDF: jsPDF: Arbitrary code execution via unsanitized input in Acroform module

🎯 Affected products46

  • Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:2fbd6c61f33b11689b4bf682ae285b4580b616791fd24260d6474432faebe577_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:7f14c15d7172a0b25b6e4c641ef3f3277ba3b0dc8dd5747e43b842c002a4a7af_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:90063788a0451b10a750ff4ac79ffd1c6f01d80c6cf0bc383c17764b81316318_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:eda563370ee592ce23521c42a5c1776a98771b5ff0b57d93a05bab51765b0c54_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:2f09b2360c12d99319b4059a14947e7732ecd6fb2f654666f277fb287649dee7_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:67fc5a13e3e9d36d173cd60a79b8844c118c8b21756f3ce3535ce8048ae51e77_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:bf2105e2af0882689a69867150470feee03dbe1b3826d6598377425c0c547d03_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:fa92afd1a8a21b5810a73b588616bd3070a5690d6bc63d7dd12d16dd16305e19_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:669b38265ef149e2361e5eada1bee14e895da0de3e687358186e0095483e1897_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:8305d417a2b71db82c3563cd0c993bc883787ac60c5dfecb94d66f956f7dd868_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:8d0cccce1b9063ed8db8d607c59e393b72bce6795275b41b3190a76db8b4d81c_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:f3f552180a0328f81481cecc617f75f15b6f34959f5918ce80abd0bfdfb9a9ed_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:e8e09e694e526ddae4ead8c2a40e961bc434a7a6678286e03fb100663f11fc8e_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:46812964173a755fc24a1ac82a1c02984cae161887ccafac4b1e98df6af3c1b2_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:621bde2cedc94c85edbc9a7818f184c4a025356cbd4d3502b9829062b177bcb9_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:c09bca8dae3ea50877dee7ed05ac3f8496b4f412f330bd27faa55721f6593083_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:c81b58c4932d1b9dd128efaeee6d8717104e12cdaf0b85cd7302d5c4e76392f4_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:2c6a9b7fb8ef88724944ad2fc9cad23660b5df20683796f308e51a0228bc79b9_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:63b0a10e5244e9aee244322df92c36b6156bfbf02de0cbcef9c2bb6934c9dafd_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:7fb0069e5d132b294144ffa692ec27cd942b7ed5a1d02c8c9c1435dd42af805b_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:b541158df2f62749c531300f6f8e96db77a9aac19f3220b7ac2b3624e0d704df_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:14add162eda9e82808a17470e961426fc12745e81a3fce5499128d4511c714dd_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:623d3fc70fbd9fd7cd8eb92ecabe61a3819b01ee70861d1609173f19a8f720d3_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:64256707c1aed9efe5bcdcdd10a4cefc64e0fcf207de3856a7f42655149d3770_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:bc9fe2b6a2c34cae54c7790b2c13ee372ffe572c4fbd6ce196cf70e5744b8384_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:0d46a6c8df0e85a36db5e373313351a8dd4989f2e2c7ef04709560c3127d7cb8_s390x as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:2de3c8f515be5525cf5ef29a087dc38836185870d1833c23b2e77d999cb98852_amd64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:398aa0d6e7ca2b1721e2efa8dd5d612eb4077328e8443f35143bdcff06a32587_arm64 as a component of Red Hat Advanced Cluster Security 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:fe79f11a25d8e1c4c216cf17a2f81ff522e189638bb6fb8883b09fc837995044_ppc64le as a component of Red Hat Advanced Cluster Security 4.9
  • +16 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, avoid processing untrusted or unverified PDF documents with applications utilizing the jsPDF library. Ensure that any input provided to jsPDF's AcroForm methods and properties is properly sanitized to prevent the injection of arbitrary PDF objects and JavaScript actions. This operational control reduces the risk of arbitrary JavaScript execution.

🔗 References (14)