RHSA-2026:52768HighCVSS 8.1

Red Hat Security Advisory: Red Hat Developer Hub 1.9.8 release.

Published
August 10, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (11)

CVE-2026-5038 →CVE-2026-13149 →CVE-2026-46625 →CVE-2026-48069 →CVE-2026-48712 →CVE-2026-49978 →CVE-2026-59869 →CVE-2026-59877 →CVE-2026-5079 →CVE-2026-48068 →CVE-2026-59892 →

📋 Description

CVE-2026-5038 — multer: Multer: Denial of Service via aborted or malformed multipart uploads CVE-2026-5079 — multer: Multer: Denial of Service via deeply nested field names in multipart form data CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-46625 — js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution CVE-2026-48068 — grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation CVE-2026-48069 — grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message CVE-2026-48712 — protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload CVE-2026-49978 — dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents CVE-2026-59877 — protobufjs: protobufjs: Denial of Service via crafted .proto schema CVE-2026-59892 — @opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding

🎯 Affected products4

  • Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:bb8c0beabdebee8c0bebdab9af6931f6ff2d3a7e063c6c76841463ec9fb66491_amd64 as a component of Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:7f831e5f23c8ea87704e9cdacd5669e83b075243e048d4c797e3a1bb14569840_amd64 as a component of Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:c7a8301849b2b5833207b7cb1c2cdd05e93d303e92636d8ca2932b4c2ea23c5c_amd64 as a component of Red Hat Developer Hub 1.9

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce the impact of this denial of service vulnerability, configure the `limits.fields` option within your `multer` instance to a reasonable maximum value. This action restricts the number of fields processed from multipart form data, thereby limiting the resources an attacker can consume. This partial mitigation requires an application restart to take effect and does not fully prevent the vulnerability. Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability. Workaround: No specific mitigation required for unaffected runtime paths. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations. Workaround: Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update. Workaround: Administrators can mitigate this issue by not configuring JaegerPropagator as the active OpenTelemetry propagator (use W3C Trace Context or B3 propagation instead), or by deploying an ingress/proxy in front of the affected service that validates or strips uber-trace-id and uberctx-* headers before they reach the application. Upgrading to @opentelemetry/propagator-jaeger >= 2.9.0 resolves the issue upstream.

🔗 References (17)