RHSA-2026:49642HighCVSS 8.1

Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 release.

Published
August 3, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (14)

CVE-2026-59869 →CVE-2026-59892 →CVE-2026-5038 →CVE-2026-5079 →CVE-2026-13149 →CVE-2026-42504 →CVE-2026-46625 →CVE-2026-48069 →CVE-2026-48801 →CVE-2026-59877 →CVE-2026-13676 →CVE-2026-45740 →CVE-2026-48068 →CVE-2026-49978 →

📋 Description

CVE-2026-5038 — multer: Multer: Denial of Service via aborted or malformed multipart uploads CVE-2026-5079 — multer: Multer: Denial of Service via deeply nested field names in multipart form data CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13676 — fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization CVE-2026-42504 — mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-45740 — protobufjs: protobufjs: Denial of Service via crafted JSON descriptors CVE-2026-46625 — js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution CVE-2026-48068 — grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation CVE-2026-48069 — grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message CVE-2026-48801 — linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability CVE-2026-49978 — dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents CVE-2026-59877 — protobufjs: protobufjs: Denial of Service via crafted .proto schema CVE-2026-59892 — @opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding

🎯 Affected products6

  • Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:08883fc7f9806289ecec95f75d4e9ee5c44a12ff372252e10398293c78b0514f_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d72d8450a0b3413ca7d115a18037a06400072f0ea8a9994677c8670f82712300_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:efb115e54a4a288615b4539726e265e51b0049339c432dd511c049985c710dbd_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:c0aa60b0f991c016062b069073a511558f3bdea44d10a1144baa5d6a7f9a4c3d_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:483b26f157935484470e7d494467763c3fe6f1f70e0ee780a17644ccb3f516e1_amd64 as a component of Red Hat Developer Hub 1.10

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce the impact of this denial of service vulnerability, configure the `limits.fields` option within your `multer` instance to a reasonable maximum value. This action restricts the number of fields processed from multipart form data, thereby limiting the resources an attacker can consume. This partial mitigation requires an application restart to take effect and does not fully prevent the vulnerability. Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package. Workaround: To mitigate this issue, avoid loading untrusted protobuf JSON descriptors in applications utilizing protobufjs. If untrusted descriptors must be processed, implement validation at an outer boundary to reject excessively nested structures. Alternatively, isolate the descriptor loading process in an environment that can be safely restarted in case of a denial of service. Workaround: Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations. Workaround: Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update. Workaround: Administrators can mitigate this issue by not configuring JaegerPropagator as the active OpenTelemetry propagator (use W3C Trace Context or B3 propagation instead), or by deploying an ingress/proxy in front of the affected service that validates or strips uber-trace-id and uberctx-* headers before they reach the application. Upgrading to @opentelemetry/propagator-jaeger >= 2.9.0 resolves the issue upstream.

🔗 References (36)