RHSA-2026:6192HighCVSS 8.8

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.0 Release.

Published
March 30, 2026
Last Modified
August 28, 2026

🔗 CVE IDs covered (19)

CVE-2026-24842 →CVE-2026-26960 →CVE-2026-1002 →CVE-2026-23950 →CVE-2026-26996 →CVE-2025-13465 →CVE-2025-69873 →CVE-2026-25639 →CVE-2026-25949 →CVE-2025-61728 →CVE-2025-61729 →CVE-2025-68121 →CVE-2026-25223 →CVE-2025-54386 →CVE-2025-61726 →CVE-2025-64756 →CVE-2026-22045 →CVE-2026-23745 →CVE-2026-24049 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-54386 — traefik: Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-64756 — glob: glob: Command Injection Vulnerability via Malicious Filenames CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-69873 — ajv: ReDoS via $data reference CVE-2026-1002 — io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files CVE-2026-22045 — traefik: Traefik: Denial of Service via ACME TLS-ALPN fast path resource exhaustion CVE-2026-23745 — node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives CVE-2026-23950 — node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking CVE-2026-24842 — node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check CVE-2026-25223 — Fastify: Fastify: Validation bypass due to malformed Content-Type header leading to integrity impact CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig CVE-2026-25949 — github.com/traefik/traefik: Traefik: Denial of Service via stalled STARTTLS requests CVE-2026-26960 — node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns

🎯 Affected products62

  • Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-rhel9@sha256:1033ffe714e728e289eddaa3809e9d21915de193813339fa5c049373e3e78719_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-rhel9@sha256:1c026c9c6fa5b70e2ab18b79f7974fe811558a4fbb3efee8eac17a165af2d4a2_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-rhel9@sha256:650e9cec2b386064718aa87d794e3264eaf3af766060e4141f6f0870347cdb64_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-rhel9@sha256:cad5f1983385201427a94f980baeefece28aedc8089425db88806d54103dfe91_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:6446db0167fbd287557bb29b9f090da15b1b0846c62df9fd96cafd0784d4769d_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:ca2b5dd80258f6d5105df99a2a4160086248ede21fd4fdb7be7d9d0e1768ec99_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:d0e058ad62081efbb2d62a979d3d52443a19d361e2bec3d1bb1a6d403c4fa336_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:ed1952126d5efdfe97f1d5411b7f057631bbae1b9c748c5f45746b6ee145fcad_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:81dc1398a2f94a040d43841f908c743f696ba9edfdd36ad47b225a90ef69da28_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:87415e884ce4a792725ebef47c95e81a4c98b594a333f5c9852ce68c13d33c09_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:acaa080820cc3886395466b4a327600752f13eb9e8728cece8bff696d92649e2_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:d160df16f213208e22f67e0261fed70a5aa6eb64a79438c7affac0748d214e08_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:272a65ee82a9484e1d4362a9f33b6cc1b0eb13d93e70b19cc3d0208f021c2bda_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:2bc4515148a52d94e1fcaf8991ddf0e9e98f0565bdae0f7f6c732feac0540d95_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:e139d927ef936bfabf780286ec4b4bf97e318db69c1af5b7473dd33ae54931b4_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:ff64d5d47c91c59904cb2a90eb9e42e563fea560407fa6c0590b964ace2ce469_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:d25e5effc8f3e6f0a02f3f1795cb83b585508b79e236b66e9a67be1511593864_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:5d1045ab74b00b9ac4888a7971adfddf03142cf73b80e427d2bdde17f8a33f7d_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:6ca64429fd2b33806f766cb84e2392bf16e85a64adeb19f687fd2f5ba588a359_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b317d159f7de28b2424c0333f48574b4b6b4852405f82a0643c0f22ff37253c6_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b98b93207d245e32fca4182f7f8debd05b853082f79eb06d513fd25eb659ab7e_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:0d44f88b37488308e5c166fbf61ef195e473949d4d8930742742d52da8bd1d09_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:49848a9d6c888956fe17c0a7faa350b1b534aa7623c6368c45fa676ec603c9a9_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:582e28a0f571b32aa45ffdde4369479efb0fa504f163caf738b2dea23ad017f0_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:8487157abf1a0cb7fb35aafdf9f5c3f3b7b3c107c5583b5cb2ceb80aabaaba75_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0504f72e32867f2e16ae91237e494ad597897d234da6c772deedeec03c77f7da_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:2c0bfdd79524706c055e32bc68b3e099beea3f19e89184e763912b964588ca7e_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4eb8ed347e951e036b5e464891ad26775288421b5ad4279e0a0a6a7682ed614a_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:ed6c681b49c827af9faad6364a9a5fff068253878597f4e2768f51e2debedabf_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • +32 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: To mitigate this issue, avoid using the `glob` command-line interface with the `-c` or `--cmd` option when processing filenames from untrusted sources. If programmatic use of `glob` is necessary, ensure that filenames are thoroughly sanitized before being passed to commands executed with shell interpretation enabled. Workaround: To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters. Workaround: To mitigate this vulnerability, consider disabling the static handler cache by configuring the StaticHandler instance with setCachingEnabled(false), for example: ~~~ StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false); ~~~ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (23)