RHSA-2026:71906MediumCVSS 6.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
September 25, 2026
Last Modified
September 25, 2026

🔗 CVE IDs covered (3)

CVE-2026-75838 →CVE-2026-86472 →CVE-2026-93981 →

📋 Description

CVE-2026-75838 — dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization CVE-2026-86472 — fast-uri: fast-uri: Security bypass due to inconsistent host case normalization CVE-2026-93981 — hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana13.2-0:13.2.1-0.7.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana13.2-0:13.2.1-0.7.hum1@src as a component of Red Hat Hardened Images
  • grafana13.2-0:13.2.1-0.7.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this vulnerability, avoid using DOMPurify with a custom IN_PLACE sanitization configuration that includes an element-removal hook. Default DOMPurify configurations are not affected by this flaw. Workaround: Applications utilizing fast-uri for host validation should implement case-insensitive comparisons by converting the parsed host to lowercase before performing any allowlist or denylist checks. This ensures that variations in host casing, including percent-encoded uppercase octets, do not lead to security bypasses.

🔗 References (8)