RHSA-2026:6802HighCVSS 9.8

Red Hat Security Advisory: Red Hat Developer Hub 1.9.3 release.

Published
April 7, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (15)

CVE-2026-2359 →CVE-2026-25679 →CVE-2025-61140 →CVE-2025-69873 →CVE-2026-24046 →CVE-2026-25639 →CVE-2026-25896 →CVE-2026-1615 →CVE-2026-3304 →CVE-2026-3520 →CVE-2026-26278 →CVE-2026-27606 →CVE-2026-33186 →CVE-2026-25153 →CVE-2026-27942 →

📋 Description

CVE-2025-61140 — jsonpath: jsonpath: Prototype Pollution vulnerability in the value function CVE-2025-69873 — ajv: ReDoS via $data reference CVE-2026-1615 — jsonpath: jsonpath: Arbitrary Code Execution via unsafe JSON Path expression evaluation CVE-2026-2359 — multer: Multer: Denial of Service via dropped file upload connections CVE-2026-3304 — multer: Multer: Denial of Service via malformed requests CVE-2026-3520 — multer: Multer: Denial of Service via malformed requests CVE-2026-24046 — backstage/backend-defaults: backstage/plugin-scaffolder-backend: backstage/plugin-scaffolder-node: possible symlink path traversal in scaffolder actions CVE-2026-25153 — @backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25896 — fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling CVE-2026-26278 — fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion CVE-2026-27606 — rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability CVE-2026-27942 — fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products4

  • Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:5e564d74dd0a96027d9283991bda32a13b87384a9c9572456ce318dfac7e9f7d_amd64 as a component of Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:6d52fc14afcaa18b7a09607fcdc34edf3b222030aa69cc91612a38191aca41aa_amd64 as a component of Red Hat Developer Hub 1.9
  • registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:4e4ab9dd3243274e6f378553e241ae8b9fdeed7fe2daaa7efb34f60ee46a2eef_amd64 as a component of Red Hat Developer Hub 1.9

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, consider implementing strict access controls for Backstage Scaffolder templates. Restrict the ability to create and execute Scaffolder templates to trusted users only, utilizing the Backstage permissions framework. Additionally, audit existing templates for any symlink usage and consider running Backstage within a containerized environment with a highly restricted filesystem to limit potential impact. Workaround: To mitigate this vulnerability, configure applications using the `fast-xml-parser` XML builder to set the `preserveOrder` option to `false`. Alternatively, ensure that all XML input data is thoroughly validated before being passed to the builder to prevent the processing of malicious or malformed content. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (22)