RHSA-2026:88151CriticalCVSS 9.8

Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.

Published
October 22, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (45)

CVE-2026-78254 →CVE-2026-84645 →CVE-2026-84655 →CVE-2026-90852 →CVE-2026-10051 →CVE-2026-47886 →CVE-2026-71889 →CVE-2026-84651 →CVE-2026-84654 →CVE-2026-89425 →CVE-2026-91777 →CVE-2026-92125 →CVE-2026-19203 →CVE-2026-58062 →CVE-2026-59283 →CVE-2026-68498 →CVE-2026-87824 →CVE-2026-89407 →CVE-2026-12611 →CVE-2026-71888 →CVE-2026-84647 →CVE-2026-87825 →CVE-2024-38827 →CVE-2026-58059 →CVE-2026-84648 →CVE-2026-87877 →CVE-2026-89046 →CVE-2026-47888 →CVE-2026-59282 →CVE-2026-59649 →CVE-2026-59651 →CVE-2026-92123 →CVE-2026-10050 →CVE-2026-12185 →CVE-2026-84649 →CVE-2026-84650 →CVE-2026-84652 →CVE-2026-14682 →CVE-2026-18660 →CVE-2026-68497 →CVE-2026-75140 →CVE-2026-84653 →CVE-2026-87795 →CVE-2026-90560 →CVE-2026-12860 →

📋 Description

CVE-2024-38827 — spring-security: authorization bypass for case sensitive comparisons CVE-2026-10050 — jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision CVE-2026-10051 — jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections CVE-2026-12185 — bouncycastle: Bouncy Castle: Denial of Service via untrusted keystore length allocation CVE-2026-12611 — org.eclipse.jetty.http2/http2-common: org.eclipse.jetty.http2/jetty-http2-common: Jetty: Denial of Service via HTTP/2 race condition CVE-2026-12860 — org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification CVE-2026-14682 — org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: org.bouncycastle/bc-fips: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service due to unbounded memory allocation CVE-2026-18660 — org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering CVE-2026-19203 — org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests CVE-2026-47886 — Spring Framework: org.springframework/spring-expression: Spring Framework: Denial of Service via unbounded exponentiation in SpEL expressions CVE-2026-47888 — Spring Framework: Spring Framework: Memory leak via malformed RSocket SETUP frame CVE-2026-58059 — org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names CVE-2026-58062 — org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcprov-jdk15on: Bouncy Castle for Java: Certificate validation bypass via stapled OCSP response CVE-2026-59282 — org.springframework:spring-beans: Spring Framework: Denial of Service via unbounded list growth in data binding CVE-2026-59283 — org.springframework:spring-expression: Spring Framework: Safety Guard Bypass via SpEL Expression Compilation CVE-2026-59649 — org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length CVE-2026-59651 — org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: Bouncy Castle for Java: Weak integrity protection in BKS keystore CVE-2026-68497 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing CVE-2026-68498 — com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names CVE-2026-71888 — bouncycastle: bouncycastle-fips: Bouncy Castle: Security bypass via unvalidated attributes in CMS AuthenticatedData parser CVE-2026-71889 — org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-lts8on: bouncycastle: Bouncy Castle: Certificate validation bypass via missing name constraint checks CVE-2026-75140 — org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents CVE-2026-78254 — org.apache.ant/ant: Apache Ant: Arbitrary file write via path traversal in ftp and scp tasks CVE-2026-84645 — jenkins: Jenkins: Remote Code Execution via crafted configuration files CVE-2026-84647 — Stapler: Jenkins: Stapler: Unintended configuration object instantiation via form data binding CVE-2026-84648 — jenkins: Jenkins: Stored cross-site scripting vulnerability in system log viewer CVE-2026-84649 — jenkins: stapler: Stapler: Cross-site request forgery token disclosure allows session hijacking CVE-2026-84650 — jenkins: Jenkins: Configuration overwrite via transient field deserialization CVE-2026-84651 — jenkins: Jenkins: Privilege escalation via agent configuration overwrite CVE-2026-84652 — jenkins: Jenkins: Authentication bypass via session cookie non-rotation CVE-2026-84653 — jenkins: Jenkins: Unauthorized configuration modification due to incorrect permission checks CVE-2026-84654 — org.kohsuke.stapler/stapler: jenkins: Stapler: Global configuration modification via form data binding CVE-2026-84655 — jenkins: Jenkins: Information injection via unescaped map keys in REST API CVE-2026-87795 — com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service CVE-2026-87824 — com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect CVE-2026-87825 — com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability CVE-2026-87877 — com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service CVE-2026-89046 — zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read CVE-2026-89407 — com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89425 — com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing CVE-2026-90560 — com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress CVE-2026-90852 — com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing CVE-2026-91777 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion CVE-2026-92123 — jenkins-script-security-plugin: org.jenkins-ci.plugins/script-security: jenkins-plugin/script-security: Jenkins Script Security Plugin: Arbitrary code execution via sandbox bypass CVE-2026-92125 — org.jenkins-ci.plugins/script-security: Jenkins Script Security Plugin: Arbitrary code execution via Groovy AST transformation bypass

🎯 Affected products9

  • OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:12c22adcc3658e499e5c3bb41beeacd720a85cc4a20b4a4afd7c70c0ca6b5e9b_amd64 as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:64a302c96fe2ec40c544acd95a30a0c9ccc218f84f31f3bdd199489da081484a_arm64 as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:a05b7706b0a45b6a87d3864408595a77bcfcdd034aba389b4a3427e48077215a_s390x as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:de9fb004442014f9facfade2427a12d40b3d2868568db2211445edf612e1347b_ppc64le as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:238668e54ad9af2e06b4dd44d228d237a012d3c4ca63db8d67558cd5e5963c48_ppc64le as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9b2f4a67ed2e0fb3336ede98aa08ff729349f8937540f0179678a108e043f6e5_arm64 as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:c03355915f59dd67f6465e52586330f519ac97b9013ddc278867555ced2d9fac_amd64 as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:ca36e015c03fdb7fc6db4a853543b54e13089209b29edca03d0ced3ead13ccd7_s390x as a component of OpenShift Developer Tools and Services 4.14

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4-14 upgrade to the latest. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this vulnerability, ensure that all user passwords configured for HTTP Digest authentication in affected Eclipse Jetty deployments exclusively use characters within the Latin-1 character set. This prevents the character encoding collision that leads to authentication bypass. Workaround: Enforce strict DigestInfo encoding checks requiring explicit ASN.1 NULL parameters in RSA PKCS#1 v1.5 signature verification, or mandate the use of RSA-PSS signature schemes in application TLS/crypto configuration. Workaround: Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, BC-FJA bc-fips 1.0.2.7/2.0.2/2.1.3, or bctls-fips 1.0.24) once available for the affected product. Workaround: There is no mitigation for this issue other than applying the fix. As a temporary workaround, administrators who rely on Jetty host allow/deny filtering should add case-variant duplicates of every configured hostname to the filter lists, or enforce hostname case-normalization at an upstream load balancer or reverse proxy, until the update is installed. Workaround: Avoid evaluating untrusted, user-supplied Spring Expression Language (SpEL) input. Where SpEL evaluation of user input is mandatory, configure custom MethodResolvers or PropertyAccessors to sanitize expressions, or enforce strict execution timeouts and character white-listing upstream before expression parsing. Workaround: Disable RSocket transport listeners on the application if RSocket features are not actively utilized. If RSocket is required, restrict network connectivity to the RSocket port using ingress firewalls, API gateways, or service mesh network policies. Workaround: Limit the maximum string length of incoming X.500 distinguished names at application or API gateway boundaries, or restrict the acceptance of unauthenticated client certificates containing complex distinguished names. Workaround: Where Bouncy Castle performs PKIX revocation checking with stapled OCSP, pin expected peer certificate or public-key fingerprints ([CME-404](https://cmetaxonomy.org/entries/CME-404.html)) so a stapled OCSP response for a different serial cannot substitute trust. Restrict TLS clients to trusted networks and peers ([CME-202](https://cmetaxonomy.org/entries/CME-202.html), [CME-203](https://cmetaxonomy.org/entries/CME-203.html)) to reduce man-in-the-middle opportunity against revoked certificates. If stapled OCSP is not required, avoid PKIXRevocationChecker.setOcspResponses() and use CRL or online OCSP fetch paths that enforce CertID binding. Upgrade to Bouncy Castle 1.85 or later (BC-LTS 2.73.12, or bc-fips 2.0.2 / 2.1.3) when available. Workaround: Restrict property path data binding by explicitly configuring allowed fields via `DataBinder.setAllowedFields()` or `disallowedFields` on target controller endpoints. Alternatively, avoid exposing self-populating List properties on target DTO objects bound directly to untrusted web inputs. Workaround: Disable SpEL compilation globally by setting the system property `spring.expression.compiler.mode` or configuration bean setting to `OFF`. Alternatively, restrict SpEL expression input to trusted internal sources and avoid parsing untrusted user-supplied strings via `SimpleEvaluationContext`. Workaround: Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, or BC-FJA bcpg-fips 1.0.13/2.0.13/2.1.13) once available for the affected product. Workaround: Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85 or LTS 2.73.12) once available for the affected product. Workaround: Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity. Workaround: Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength.…

🔗 References (50)