RHSA-2026:90321CriticalCVSS 9.8

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 Release.

Published
October 26, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (105)

CVE-2026-59901 →CVE-2026-67213 →CVE-2026-67313 →CVE-2026-85124 →CVE-2026-101916 →CVE-2026-8643 →CVE-2026-41707 →CVE-2026-47892 →CVE-2026-56819 →CVE-2026-68494 →CVE-2026-69152 →CVE-2026-39820 →CVE-2026-56746 →CVE-2026-59280 →CVE-2026-82417 →CVE-2026-84292 →CVE-2026-84469 →CVE-2026-12185 →CVE-2026-16308 →CVE-2026-19203 →CVE-2026-42502 →CVE-2026-67312 →CVE-2026-71290 →CVE-2026-71325 →CVE-2026-73508 →CVE-2026-59323 →CVE-2023-54404 →CVE-2025-62718 →CVE-2026-15076 →CVE-2026-17106 →CVE-2026-41178 →CVE-2026-42499 →CVE-2026-47886 →CVE-2026-56745 →CVE-2026-56852 →CVE-2026-59899 →CVE-2026-69192 →CVE-2026-71324 →CVE-2026-71327 →CVE-2026-74835 →CVE-2026-75838 →CVE-2026-13697 →CVE-2026-19534 →CVE-2026-55851 →CVE-2026-59887 →CVE-2026-75931 →CVE-2026-76169 →CVE-2026-84394 →CVE-2026-84961 →CVE-2026-56854 →CVE-2026-75899 →CVE-2026-82562 →CVE-2026-84375 →CVE-2026-85597 →CVE-2026-100666 →CVE-2026-109618 →CVE-2026-58062 →CVE-2026-59283 →CVE-2026-59296 →CVE-2026-59313 →CVE-2026-62243 →CVE-2026-73500 →CVE-2026-85062 →CVE-2026-88007 →CVE-2026-50010 →CVE-2026-84445 →CVE-2026-85152 →CVE-2026-86063 →CVE-2026-87743 →CVE-2026-88009 →CVE-2026-88012 →CVE-2026-90711 →CVE-2026-14682 →CVE-2026-67314 →CVE-2026-67320 →CVE-2026-67321 →CVE-2026-93749 →CVE-2026-68497 →CVE-2026-45416 →CVE-2026-47884 →CVE-2026-55833 →CVE-2026-84428 →CVE-2026-100656 →CVE-2026-102925 →CVE-2026-103435 →CVE-2026-59651 →CVE-2026-47888 →CVE-2026-88031 →CVE-2026-109619 →CVE-2026-9496 →CVE-2026-88878 →CVE-2026-88879 →CVE-2026-102930 →CVE-2026-47890 →CVE-2026-59282 →CVE-2026-64607 →CVE-2026-88004 →CVE-2026-88008 →CVE-2026-100655 →CVE-2026-81521 →CVE-2026-84504 →CVE-2026-85595 →CVE-2026-88011 →CVE-2026-55831 →CVE-2026-18427 →

📋 Description

CVE-2023-54404 — zod: zod: Denial of service via unbounded array validation CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-8643 — python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite CVE-2026-9496 — pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-12185 — bouncycastle: Bouncy Castle: Denial of Service via untrusted keystore length allocation CVE-2026-13697 — undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives CVE-2026-14682 — org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: org.bouncycastle/bc-fips: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service due to unbounded memory allocation CVE-2026-15076 — io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation CVE-2026-16308 — io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service CVE-2026-17106 — github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction CVE-2026-18427 — @fastify/static: @fastify/static: Information disclosure via route guard bypass CVE-2026-19203 — org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests CVE-2026-19534 — undici: undici: Denial of Service via unrequested WebSocket subprotocol CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-41707 — org.springframework.security/spring-security-oauth2-client: Spring Security: DPoP Proof Replay via Cache Eviction CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-45416 — netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake CVE-2026-47884 — org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47886 — Spring Framework: org.springframework/spring-expression: Spring Framework: Denial of Service via unbounded exponentiation in SpEL expressions CVE-2026-47888 — Spring Framework: Spring Framework: Memory leak via malformed RSocket SETUP frame CVE-2026-47890 — org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 — org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-50010 — netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass CVE-2026-55831 — io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing CVE-2026-55833 — netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification CVE-2026-55851 — io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message CVE-2026-56745 — netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec CVE-2026-56746 — io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header CVE-2026-56819 — io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-56854 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions CVE-2026-58062 — org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcprov-jdk15on: Bouncy Castle for Java: Certificate validation bypass via stapled OCSP response CVE-2026-59280 — org.springframework/spring-webmvc: Spring Framework: Path Traversal via untrusted input in FreeMarker integration CVE-2026-59282 — org.springframework:spring-beans: Spring Framework: Denial of Service via unbounded list growth in data binding CVE-2026-59283 — org.springframework:spring-expression: Spring Framework: Safety Guard Bypass via SpEL Expression Compilation CVE-2026-59296 — io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing CVE-2026-59313 — org.springframework/spring-webmvc: Spring MVC: Stream corruption via Server-Sent Events (SSE) CVE-2026-59323 — io.micrometer/micrometer-tracing-bridge-brave: Micrometer Tracing Brave Bridge: Denial of Service via W3C Baggage Propagation CVE-2026-59651 — org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: Bouncy Castle for Java: Weak integrity protection in BKS keystore CVE-2026-59887 — linkify-it: linkify-it: Denial of Service via crafted mailto: links CVE-2026-59899 — io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) CVE-2026-59901 — io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2) CVE-2026-62243 — io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration CVE-2026-64607 — org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak CVE-2026-67213 — nanoid: nanoid: Denial of Service via infinite loop in random ID generation CVE-2026-67312 — axios: axios: Denial of Service via uncontrolled recursion in form data processing CVE-2026-67313 — axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON CVE-2026-67314 — axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth CVE-2026-67320 — axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter CVE-2026-67321 — axios: axios: Denial of Service via object serialization bypass CVE-2026-68494 — com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser CVE-2026-68497 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing CVE-2026-69152 — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVE-2026-69192 — ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass CVE-2026-71290 — org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification CVE-2026-71324 — github.com/traefik/traefik: Traefik: Information disclosure via response poisoning in shared backend pool CVE-2026-71325 — github.com/traefik/traefik: Traefik: Namespace isolation bypass via TraefikService backendRef CVE-2026-71327 — github.com/traefik/traefik: Traefik: Cross-namespace backend hijacking due to Gateway API identity collision CVE-2026-73500 — etcd: etcd: Denial of Service via unbounded TLS handshake goroutines CVE-2026-73508 — io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names CVE-2026-74835 — inets: httpd: otp: inets httpd: Denial of Service due to memory exhaustion via unenforced body-size limit CVE-2026-75838 — dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization CVE-2026-75899 — fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75931 — fast-uri: fast-uri: Host confusion via skipped IDN canonicalization CVE-2026-76169 — fastify: fastify: Authentication bypass via malformed URLs CVE-2026-81521 — go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite CVE-2026-82417 — qs: qs: Denial of Service via improper validation in stringify function CVE-2026-82562 — qs: qs: Denial of Service via array limit bypass in query string parsing CVE-2026-84292 — fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-84394 — fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies CVE-2026-84428 — fastify: fastify: Header validation bypass via incomplete schema case normalization CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-84469 — fastify: Fastify: Request validation bypass allows unauthorized operations CVE-2026-84504 — fastify: fastify: Unauthorized state changes and data disclosure via request body replacement CVE-2026-84961 — undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options CVE-2026-85062 — colord: omgovich/colord: Colord: Denial of Service via oversized malformed color strings CVE-2026-85124 — @fastify/http-proxy: @fastify/http-proxy: Information disclosure via path traversal with backslash dot-segments CVE-2026-85152 — undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85595 — github.com/traefik/traefik: Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth CVE-2026-85597 — github.com/traefik/traefik: Traefik: Authentication bypass via TLS option conflict CVE-2026-86063 — claude-code: Claude Code: arbitrary code execution via unverified commit hash during plugin installation CVE-2026-87743 — quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security CVE-2026-88004 — github.com/traefik/traefik: Traefik: Security bypass and identity spoofing via unsanitized request trailers CVE-2026-88007 — github.com/traefik/traefik: Traefik HTTP/3 Backend NTLM Connection Reuse CVE-2026-88008 — github.com/traefik/traefik: Traefik: Incorrect authorization due to HTTP/2 protocol confusion CVE-2026-88009 — github.com/traefik/traefik: Traefik: Authorization bypass and access-log evasion via crafted HTTP/1 request CVE-2026-88011 — github.com/traefik/traefik: Traefik: Identity spoofing via dot-form header alias CVE-2026-88012 — traefik: Traefik: Denial of Service via slow HTTP/3 request bodies CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs CVE-2026-88878 — github.com/traefik/traefik: Traefik: Denial of Service via HTTP/3 timeout bypass CVE-2026-88879 — github.com/traefik/traefik: Traefik: Identity spoofing via HTTP header alias CVE-2026-90711 — proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet CVE-2026-93749 — source-map-js: source-map-js: Denial of Service via malformed indexed source maps CVE-2026-100655 — io.netty/netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams CVE-2026-100656 — io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining CVE-2026-100666 — io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec CVE-2026-101916 — grpc-js: grpc-js: Authentication bypass via improper peer certificate validation CVE-2026-102925 — virtualenv: virtualenv: Arbitrary code execution via crafted paths in activation scripts CVE-2026-102930 — virtualenv: virtualenv: Arbitrary code execution via unverified downloaded seed wheels CVE-2026-103435 — claude-code: claude-code: Arbitrary file write via TOCTOU race condition CVE-2026-109618 — php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109619 — php: fatal error handling retains stale request state leading to use-after-free

🎯 Affected products62

  • Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-rhel9@sha256:3049a7248a4ad4d649b287aae877475deafeb7b6e1d0ecbec540f816e997b568_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-rhel9@sha256:43a1bdbd4f337c81bc1a789c07d716e74a4a08f8e60374769ccd1bc202cef895_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-rhel9@sha256:7e13f4dc4021d19696666d180d9d05ed4bad0ed1ae88e78562b5bbfad7adc314_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-rhel9@sha256:f2c0813c6867724a82635c823a56077a8dd3b9322bcd6fcb0f4bf6dc05107a23_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:11c73dd00773e8df773a920d6b983649444630725b403720cc22f61dcbd9a88a_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:12ee43f548b9bbc51657e77500f399dfef7ef633b5e162007d627246a773981f_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:776d8fae8372638c1824a823eb5e5f9f76a1130493e979ffdeb0d5d1102b7542_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:956eeb6721b90d9024927c2afe185f9263329bd919a0ed9aa07d55d1b1deaab8_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:2e8188fdf97e15872ed626bd136071a20200791a879245ca911dcd1063b19732_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:5b0b6b676014f1c8d8ad5d6bc99aedadaf20b5846dc68c007026592541e9d29d_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:763324f7c02cc40a8217fc8daf103b5180d1be865fe8c366f877caae08ec0198_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:b72b4f747473061d4cea48ba76b318323e2d24714f020a6e7053ed641d864d76_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:01a0a766d5f13271a60cd6e2747760e4e9a741ef112fe5e9558fdc74ef2c5cff_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:169c11b438d9308b47b3ff9db32482b56581c725459393a04c3aeb2493743a8e_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:e054ba4dfbd318419796b9e604850ba3387b3485fa2e3d75e49d766e15574b42_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:fada2e23889911805c7122c6dc4571ecc4976b1a9250f2b300a532794e5499f9_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:3ce6e51c799e2453155058b1e21da125f9a1d1b7107d1cc6fc27bfe4bc4c6ce7_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1cb02a116a4e4ced10ce72ce7e33a8561bebbc3a193d9cfc9105ef02ae460486_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:3b26b0470955d4675172239466f4fb5c92a44b85eb830270bd8b7f6a1bb5b784_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:7ce60bc263471d3726dbbb6edfac0c2a4b58d23adb414f63f604440ba783fce5_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:fc9d7862ed6b0ce5ffe92cdaaee509b2ae161992b8f9bdfdb6865ccb04327d35_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:4a7c40e705dd0b17f4f91f29479b0818ed138e0442a65daa3292f5663dbfc52c_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:694b88929ec77e63de90cd3dcb9f3e0899182f430c973d2b1367a2bec83e8b2f_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:acbe8a4b057e7e659e3d421634e9115b49a9a244e6c46a96e0f131a11cae167c_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:acc41ca9440443de6018641e9d8c37a31fe32ab4e6747edd022cb8ed63d5bb0f_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0c38a05e03b0b4bcd6156c3c43667436cb2b31b41ea6c1a806ce062c4b051b1f_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:1723204012943c8844d04645d564955d20cd22c720f06f33e7f86181454fea55_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:2dcc79c07726598b1c8a6b398d2da30503a3dae96e640963eb2b18a85a7dd7b2_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:8b784c0c62cbbc470c624f08b145a02a5054216398cf7d3554400a9ff926b7ed_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • +32 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, users should avoid installing Python wheels from untrusted sources. It is strongly advised against using `pip install` with elevated privileges, such as `sudo`, when installing wheels. Additionally, administrators should inspect `entry_points.txt` within wheels for path separators or absolute paths before installation. Workaround: To mitigate this limit the length of incoming package specifiers (spec.rawSpec) before they reach the resolution service. Enforce hard CPU time limits or timeouts on isolated build jobs and package resolution processes. Workaround: Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, BC-FJA bc-fips 1.0.2.7/2.0.2/2.1.3, or bctls-fips 1.0.24) once available for the affected product. Workaround: To mitigate this issue, avoid processing tar archives from untrusted sources. When handling archives from potentially untrusted origins, ensure that the extraction process is executed with the least privileges necessary to limit the impact of any arbitrary file write attempts. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input. Workaround: To mitigate this issue, configure applications utilizing Netty's `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application's documentation for details on configuring Netty's TLS handler. A restart of the affected application or service is required for the configuration changes to take effect. Workaround: There is no upstream-provided workaround; the Spring project's guidance is to upgrade to a fixed version. However, applications can avoid this vulnerability without upgrading by not using XsltView together with a broad/catch-all URL mapping that omits an explicit view name — explicitly specifying the view name for any controller or handler that renders a view prevents an attacker from controlling which XSLT stylesheet is loaded. For Red Hat Fuse 7, which is in Extended Life Support Phase 2 and will not receive a fix for this issue, this configuration-based workaround is the only available mitigation. Workaround: Avoid evaluating untrusted, user-supplied Spring Expression Language (SpEL) input. Where SpEL evaluation of user input is mandatory, configure custom MethodResolvers or PropertyAccessors to sanitize expressions, or enforce strict execution timeouts and character white-listing upstream before expression parsing. Workaround: Disable RSocket transport listeners on the application if RSocket features are not actively utilized. If RSocket is required, restrict network connectivity to the RSocket port using ingress firewalls, API gateways, or service mesh network policies. Workaround: Disable view fragment rendering within Server-Sent Event (SSE) endpoints and emit fully instantiated responses or standardized DTOs instead. Workaround: Applications should avoid relying solely on header-based route predicates (headers(...)) in WebFlux functional endpoint configurations to enforce security-relevant access control, since this bypass allows such guards to be circumvented via a crafted CORS pre-flight request. Combining header predicates with a dedicated authentication/authorization layer (e.g., Spring Security) prevents exploitation of this specific issue. For Red Hat Fuse 7, which is in Extended Life Support Phase 2 and will not receive a fix for this issue, this configuration- based guidance is the only available mitigation. Workaround: If CORS short-circuit functionality is not required, disable the shortCircuit() configuration in the CorsHandler. Alternatively, implement application-level origin validation to reject requests with null Origin headers. A web application firewall (WAF) can also be configured to block requests with null or missing Origin headers. Workaround: Where Bouncy Castle performs PKIX revocation checking with stapled OCSP, pin expected peer certificate or public-key fingerprints ([CME-404](https://cmetaxonomy.org/entries/CME-404.html)) so a stapled OCSP response for a different serial cannot substitute trust. Restrict TLS clients to trusted networks and peers ([CME-202](https://cmetaxonomy.org/entries/CME-202.html), [CME-203](https://cmetaxonomy.org/entries/CME-203.html)) to reduce man-in-the-middle opportunity against revoked certificates. If stapled OCSP is not required, avoid PKIXRevocationChecker.setOcspResponses() and use CRL or online OCSP fetch paths that enforce CertID binding. Upgrade to Bouncy Castle 1.85 or later (BC-LTS 2.73.12, or bc-fips 2.0.2 / 2.1.3) when available. Workaround: Restrict property path data binding by explicitly configuring allowed fields via `DataBinder.setAllowedFields()` or `disallowedFields` on target controller endpoints. Alternatively, avoid exposing self-populating List properties on target DTO objects bound directly to untrusted web inputs. Workaround: Disable SpEL compilation globally by setting the system property `spring.expression.compiler.mode` or configuration bean setting to `OFF`. Alternatively, restrict SpEL expression input to trusted internal sources and avoid parsing untrusted user-supplied strings via `SimpleEvaluationContext`. Workaround: There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams. As a temporary workaround, ensure that Server-Sent Events use structured formats like JSON instead of plain text for all user-controlled data. Workaround: Update io.micrometer:micrometer-tracing-bridge-brave to version 1.6.7 or later. As a workaround, configure network components (HTTP servers, proxies, load balancers) to enforce strict limits on HTTP header sizes, particularly for the `baggage` header. Applications can also disable baggage propagation if this feature is not required, or implement application-level validation to reject requests with excessively large baggage headers. Workaround: Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85 or LTS 2.73.12) once available for the affected product. Workaround: This vulnerability only affects applications that explicitly configure Netty to use the OpenSSL TLS provider (SslProvider.OPENSSL). The following mitigations can reduce exposure without applying a patch: 1) Use the default JDK SSL provider — Do not configure SslProvider.OPENSSL in your Netty SslContext setup. The default JDK SSL provider (SslProvider.JDK) is not affected by this vulnerability. Most applications use the JDK default unless explicitly overridden. 2) Use X509ExtendedTrustManager — If the OpenSSL provider is required, ensure the configured trust manager extends X509ExtendedTrustManager rather than the plain X509TrustMan…

🔗 References (109)