RHSA-2026:44696HighCVSS 8.6

Red Hat Security Advisory: satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview

Published
July 23, 2026
Last Modified
September 15, 2026

🔗 CVE IDs covered (9)

CVE-2025-66418 →CVE-2025-66471 →CVE-2026-21441 →CVE-2026-24486 →CVE-2026-44431 →CVE-2026-54283 →CVE-2026-42561 →CVE-2026-48710 →CVE-2025-62727 →

📋 Description

CVE-2025-62727 — starlette: Starlette DoS via Range header merging CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-24486 — python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability CVE-2026-42561 — python-multipart: python-multipart: Denial of Service via excessive multipart part headers CVE-2026-44431 — urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers CVE-2026-48710 — starlette: Starlette: Security restriction bypass via malformed HTTP Host header CVE-2026-54283 — starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

🎯 Affected products2

  • Red Hat Satellite 6.17
  • registry.redhat.io/satellite/iop-advisor-engine-rhel9@sha256:4b6fce95a23d5cc33982fb8da817650d29785db4940dbcf321d4c4afca39911e_amd64 as a component of Red Hat Satellite 6.17

✅ Remediation

The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. For more information about the image, search the <image_name> in the Red Hat Ecosystem Catalog: https://catalog.redhat.com/software/containers/search. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this vulnerability, avoid enabling the `UPLOAD_KEEP_FILENAME=True` configuration option in applications using `python-multipart`. This option, when used with `UPLOAD_DIR`, allows an attacker to write files to arbitrary locations. Disabling or not configuring `UPLOAD_KEEP_FILENAME=True` prevents the path traversal vulnerability. Workaround: Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes. If custom middleware is present, it should be updated to use `request.scope["path"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.

🔗 References (14)