RHSA-2026:62851HighCVSS 8.6

Red Hat Security Advisory: Red Hat Developer Hub 1.10.4 release.

Published
September 2, 2026
Last Modified
September 15, 2026

🔗 CVE IDs covered (10)

CVE-2026-41178 →CVE-2026-54272 →CVE-2026-56858 →CVE-2026-56859 →CVE-2026-69152 →CVE-2026-33818 →CVE-2026-56860 →CVE-2026-56862 →CVE-2026-67312 →CVE-2026-69192 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-54272 — ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-67312 — axios: axios: Denial of Service via uncontrolled recursion in form data processing CVE-2026-69152 — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVE-2026-69192 — ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

🎯 Affected products6

  • Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:6d6fb29bd26ff5f8ee2df1302cc228c1358a9dfde83f9609f0f6e24e8a6be7c4_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:38374b57f1896ba7be54a5778ba55aa0e6766443c5421c6481a82f909cfacc51_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:2ab3f3e5b5f70fdbb03800a0283d5d63dd205d31981786fb8931681d763dc5c8_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:4d281d580aa4f6a46647e0dd93a6fea9398f35475d4c04d56a326af9ab2a561f_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:195d22656d8dbcdeca6a7f262caa95315292b2fa89406155d2c5a041ae3d2d5b_amd64 as a component of Red Hat Developer Hub 1.10

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to axios >= 1.18.0 (1.x) or >= 0.33.0 (0.x), which add recursion depth guards to formDataToJSON. If an immediate upgrade is not possible, validate and limit the nesting depth of FormData field names before passing them to axios.formToJSON() or before sending FormData through axios with Content-Type: application/json, and ensure error handling is in place to catch RangeError exceptions from this code path. Workaround: To mitigate this vulnerability, do not pass untrusted input to the expand() function.

🔗 References (35)