RHSA-2026:62260HighCVSS 10.0

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.0 Release.

Published
September 1, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (70)

CVE-2026-47691 →CVE-2026-53622 →CVE-2026-55831 →CVE-2026-9277 →CVE-2026-10051 →CVE-2026-13149 →CVE-2026-56746 →CVE-2026-65601 →CVE-2026-45623 →CVE-2026-53488 →CVE-2026-54399 →CVE-2026-56745 →CVE-2026-68494 →CVE-2026-55833 →CVE-2025-55163 →CVE-2026-9563 →CVE-2026-41242 →CVE-2026-49978 →CVE-2026-59877 →CVE-2026-42264 →CVE-2026-12151 →CVE-2026-39835 →CVE-2026-40898 →CVE-2026-54428 →CVE-2026-54513 →CVE-2026-59874 →CVE-2026-69153 →CVE-2026-41695 →CVE-2026-44705 →CVE-2026-46681 →CVE-2026-50010 →CVE-2026-45149 →CVE-2026-54763 →CVE-2026-59873 →CVE-2026-73566 →CVE-2026-9547 →CVE-2026-45674 →CVE-2026-50193 →CVE-2026-67213 →CVE-2026-73086 →CVE-2026-59869 →CVE-2026-27136 →CVE-2026-39820 →CVE-2026-39831 →CVE-2026-48020 →CVE-2026-15076 →CVE-2026-8286 →CVE-2026-10050 →CVE-2026-40983 →CVE-2026-46597 →CVE-2026-59296 →CVE-2026-73646 →CVE-2026-15075 →CVE-2026-59888 →CVE-2026-42499 →CVE-2026-48068 →CVE-2026-53492 →CVE-2026-67214 →CVE-2026-48491 →CVE-2026-54512 →CVE-2026-40984 →CVE-2026-56819 →CVE-2026-59899 →CVE-2026-75838 →CVE-2026-34986 →CVE-2026-45416 →CVE-2026-65600 →CVE-2026-69152 →CVE-2026-12143 →CVE-2026-41716 →

📋 Description

CVE-2025-55163 — netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability CVE-2026-8286 — curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-9547 — curl: curl: Man-in-the-middle attack via SSH host key bypass CVE-2026-9563 — org.eclipse.parsson/parsson: Eclipse Parsson: Denial of Service via uncontrolled resource consumption in JSON parsing CVE-2026-10050 — jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision CVE-2026-10051 — jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-12151 — undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-15075 — vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects CVE-2026-15076 — io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-40898 — github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers CVE-2026-40983 — micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests CVE-2026-40984 — micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests CVE-2026-41242 — protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields CVE-2026-41695 — Spring Data Commons: Spring Data Commons: Denial of Service via crafted property path strings CVE-2026-41716 — Spring Data Commons: Spring Data Commons: Denial of Service due to cache exhaustion via attacker-supplied strings CVE-2026-42264 — axios: Axios: Prototype pollution allows information disclosure and request manipulation CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-44705 — tmp: path Traversal via unsanitized prefix/postfix enables directory escape CVE-2026-45149 — brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges CVE-2026-45416 — netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake CVE-2026-45623 — postcss: PostCSS: Information disclosure and denial of service via crafted CSS input CVE-2026-45674 — netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-46681 — @nevware21/ts-utils: @nevware21/ts-utils: Arbitrary Code Execution via Prototype Pollution CVE-2026-47691 — io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records CVE-2026-48020 — github.com/traefik/traefik: Traefik: Authentication bypass in StripPrefix middleware allows unauthorized access to protected paths CVE-2026-48068 — grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation CVE-2026-48491 — Traefik: Traefik: Unauthorized access due to mutual TLS bypass CVE-2026-49978 — dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution CVE-2026-50010 — netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass CVE-2026-50193 — jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing CVE-2026-53488 — github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin CVE-2026-53492 — github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. CVE-2026-53622 — github.com/traefik/traefik: Traefik: mTLS enforcement bypass due to HTTP/3 TLS configuration flaw CVE-2026-54399 — org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers CVE-2026-54428 — org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks CVE-2026-54512 — jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass CVE-2026-54513 — jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54763 — traefik: Traefik: Identity spoofing via improper header handling in authentication middlewares CVE-2026-55831 — io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing CVE-2026-55833 — netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification CVE-2026-56745 — netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec CVE-2026-56746 — io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header CVE-2026-56819 — io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak CVE-2026-59296 — io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents CVE-2026-59873 — tar: node-tar: Denial of Service via crafted gzip bomb CVE-2026-59874 — tar: Node-tar: Denial of Service via malformed tar archive header CVE-2026-59877 — protobufjs: protobufjs: Denial of Service via crafted .proto schema CVE-2026-59888 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records CVE-2026-59899 — io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) CVE-2026-65600 — traefik: Traefik: Authentication bypass via path traversal in ReplacePathRegex middleware CVE-2026-65601 — github.com/traefik/traefik/v3: traefik: Traefik: Privilege Escalation via Kubernetes Gateway API Namespace Confusion CVE-2026-67213 — nanoid: nanoid: Denial of Service via infinite loop in random ID generation CVE-2026-67214 — nanoid: nanoid: Denial of Service via negative size input in non-secure module functions CVE-2026-68494 — com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser CVE-2026-69152 — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVE-2026-69153 — postcss: PostCSS: Information disclosure via crafted sourceMappingURL CVE-2026-73086 — nanoid: nanoid: Predictable ID generation due to integer overflow CVE-2026-73566 — tar: node-tar: Denial of Service via crafted long-path tar archive CVE-2026-73646 — postcss: PostCSS: Information disclosure via path traversal in source map auto-loading CVE-2026-75838 — dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

🎯 Affected products66

  • Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/code-rhel9@sha256:37194dd2cd72d6cdb57ca93fd1cfe6e4aa70ec826a3e86032cde0d0738262bd2_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/code-rhel9@sha256:5fcb1e5c626c5d3aa85e0ec98062a44803d2815871236a3b7541b95078997c78_s390x as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/code-rhel9@sha256:8f84e4d5f4cf71219fbed65092645ded0df00369b42b5487ddef7d0c6cac331b_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/code-rhel9@sha256:e576efc0fbec5378a870880a7bce40327a86203f2ff426fb62d8c767f125761a_arm64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:5093c89215a4dd74643a2911ce3e3f9e351fda5adf71ee897b7b702840025d47_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:803f8b179959a2b20c71876814b09bae7e5ee15cc2dc0a7e7e1fded75a52fc8c_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:af4e4fde13a96dd7fd6126bc67927e1873f12fc3263f749527603e60e75e8f5e_s390x as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:bce9235e326ab64aabbe7080ca74cbd24d6f9090819d82d9f2f7abb814e3b26f_arm64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:0a1d01a849daf85556bea32c69dde2621021d28ed33c6f1268375345df1c9409_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:14a9baa0a9f39517264880f36689046f91f4ddadd383de1a28a56468de08c7bd_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:b2cd6a2da440d20b39571dbee7bd31c49ad7a7411530735c8896ac38e30ce4b3_s390x as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:b3bba37ab9e9d214ff805510072ea56ea9a2e0bc07c42244bc330dd595befedb_arm64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:08bb9bfbb83303d07932903db066c32bfdd3f2acbffd99b40de60e61ab05175b_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:467c2c6858ff7ea5a2c6dca1bb95638c9bc4f99ebcda932bb3bfc65f82f82155_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:6ec7b2a574f90ee5629cae48ce32544fb429aadbbee22eb88992932e7e80a28a_s390x as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca56033e3eec4a8fc2432418141f5c76a4c7c52391d14ff023c67f5c315cae39_arm64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:3f4b18a7d40ff1b17e6610ab2e6a79b77e3e9f9026b2d1a77f2892ae3ec7c4a0_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:562e100628a6d9b06f519e8d2a555bdaa43b79e7f30870dc94da9c87dac3fcb6_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:5b96816dc89ecd3b6db02011805a3ed9069f5db86b4158eac8b2f931f0e9532b_arm64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:cd0d86c44dc30c77d2876540a75249fbcb0cb1b3ecf4d14394f6eebe2061f9a6_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d98a5605205445fe1fd9a8f439b09918eb187eef468a0546a911c5ee1d00f851_s390x as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:130cf3c00d9042bdc07da56eee755b2682a13f77b9bd445ca9369e7aee9f02cf_s390x as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5f5b25b4cbfa35f731247c948d83f31b100fa99c0126a964fbd46bab9c204b55_arm64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:7f0a8c6cdbc3031e5e0193819310640f115a658ff4883914b1876c9a21dc010a_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:c722c2cdf62c8dc9953dde8a5cb283c3afece2e7925b4213c6cb6afa76004f29_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:188e877e1d78b19fa479d4b2815fc0d48fb8a048274d7f3aa37f5bf7e16523dd_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:36779d828279ae8078a29ce39ed42d8311fe40fb13347533e2d0652a23a2324f_s390x as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:8e216bcc9a9f70469bbd1b91e94d30e74d6fb8cc650bf2ca562a0aa6e82591f7_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:9889305d3ba264f5e015a58e355840b90807995d2e1fb672e64c42fd4d4f070b_arm64 as a component of Red Hat OpenShift Dev Spaces 3.30
  • +36 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, ensure that all user passwords configured for HTTP Digest authentication in affected Eclipse Jetty deployments exclusively use characters within the Latin-1 character set. This prevents the character encoding collision that leads to authentication bypass. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: To mitigate this issue, configure applications utilizing Vert.x HttpClient to strictly validate and restrict the URLs to which HTTP requests can be redirected. Implement allowlists for trusted domains and ensure that any user-supplied or external URLs processed by Vert.x HttpClient are thoroughly sanitized and validated to prevent redirection to attacker-controlled destinations. This may involve updating application-specific configurations or implementing custom URL validation logic. A service restart or reload may be required for changes to take effect. Workaround: To mitigate this issue, restrict network access to services exposing Micrometer's gRPC endpoints to trusted clients only. Implement firewall rules to limit inbound connections to the specific ports used by gRPC. If gRPC functionality is not essential for the deployment, consider disabling it entirely to eliminate the attack vector. Any changes to network configurations or service settings may require a service restart to take effect, potentially impacting availability during the transition. Workaround: To mitigate this vulnerability, validate and sanitize any user-controlled data before it is passed to the prefix, postfix or dir options of the file or directory creation functions, specifically rejecting or stripping input containing path traversal sequences. Workaround: To mitigate this issue, configure applications utilizing Netty's `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application's documentation for details on configuring Netty's TLS handler. A restart of the affected application or service is required for the configuration changes to take effect. Workaround: Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability. Workaround: To mitigate this issue, avoid configuring Traefik with wildcard host rules (e.g., Host(*.example.com)) alongside strict TLS options such as RequireAndVerifyClientCert on entrypoints that also serve permissive SNI configurations. Alternatively, restrict network access to Traefik's entrypoints to trusted networks only, thereby limiting potential exposure. Workaround: Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path. Workaround: To mitigate this issue, disable HTTP/3 (QUIC) on Traefik entrypoints. This prevents the TLS configuration selection flaw that leads to mTLS bypass. Consult Traefik documentation for specific configuration steps to disable HTTP/3. Restarting the Traefik service will be required for the changes to take effect. Workaround: To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect. Workaround: Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application’s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change. As an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted application packages and avoid broad or permissive type validation rules. Workaround: If CORS short-circuit functionality is not required, disable the shortCircuit() configuration in the CorsHandler. Alternatively, implement application-level origin validation to reject requests with null Origin headers. A web application firewall (WAF) can also be configured to block requests with null or missing Origin headers. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations. Workaround: Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update. Workaround: To mitigate this issue, ensure application code validates the size parameter passed to customAlphabet or customRandom, rejecting or sanitizing zero-value inputs before passing them to nanoid. Workaround: Sanitize all user-supplied integer inputs before passing them to `nanoid` or `customAlphabet` functions in the `nanoid/non-secure` module, ensuring the size parameter is strictly a non-negative integer. Workaround: To mitigate this vulnerability, do not pass untrusted in…

🔗 References (74)