RHSA-2026:62544HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
September 2, 2026
Last Modified
September 6, 2026

🔗 CVE IDs covered (2)

CVE-2026-82417 →CVE-2026-82562 →

📋 Description

CVE-2026-82417 — qs: qs: Denial of Service via improper validation in stringify function CVE-2026-82562 — qs: qs: Denial of Service via array limit bypass in query string parsing

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana13-1-main@aarch64 as a component of Red Hat Hardened Images
  • grafana13-1-main@src as a component of Red Hat Hardened Images
  • grafana13-1-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: If an immediate upgrade to qs 6.16.0 is not feasible, avoid re-serializing attacker-influenced parsed query or body objects with qs.stringify. Where qs.parse is used directly, set allowPrototypes: false unless prototype keys are required. For Express applications, review whether the default query parser configuration is necessary. Wrapping qs.stringify calls in try/catch can limit impact to individual requests. Workaround: Until an updated qs dependency is available in your Red Hat product, limit exposure as follows: 1. If your application calls qs.parse() directly, avoid enabling both comma:true and throwOnLimitExceeded:true when parsing untrusted query strings or urlencoded request bodies. Disable one of these non-default options, or upgrade qs to version 6.16.0 or later. 2. Where qs is included only as a transitive dependency, apply product updates that ship qs 6.16.0 or later when they become available. 3. Enforce HTTP request-line and request-body size limits at your ingress or application server. Because allocated memory scales with attacker-supplied input size, transport-layer limits bound worst-case impact. Host operating systems are not directly affected. These steps apply to application processes that use qs with the vulnerable configuration.

🔗 References (6)