RHSA-2026:99044CriticalCVSS 8.1

Red Hat Security Advisory: Red Hat Developer Hub 1.10.7 release.

Published
November 11, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (23)

CVE-2026-111758 →CVE-2026-114406 →CVE-2026-78669 →CVE-2026-87018 →CVE-2026-106492 →CVE-2026-106503 →CVE-2026-109869 →CVE-2026-109932 →CVE-2026-111759 →CVE-2026-116576 →CVE-2026-106500 →CVE-2026-87029 →CVE-2026-102278 →CVE-2026-109383 →CVE-2026-111497 →CVE-2026-111943 →CVE-2026-113872 →CVE-2026-102276 →CVE-2026-106498 →CVE-2026-106501 →CVE-2026-109829 →CVE-2026-109841 →CVE-2026-109924 →

📋 Description

CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-87018 — undici: undici: Denial of Service via TLS renegotiation with mismatched certificate CVE-2026-87029 — undici: undici: Denial of Service via unhandled exception in decompress interceptor CVE-2026-102276 — brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns CVE-2026-102278 — brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns CVE-2026-106492 — @backstage/backend-defaults: @backstage/backend-defaults: Access control bypass via improper service credential delegation CVE-2026-106498 — @backstage/plugin-catalog-backend: @backstage/plugin-catalog-backend: Information disclosure via improper URL validation in entity placeholders CVE-2026-106500 — @backstage/plugin-scaffolder-backend: @backstage/plugin-scaffolder-backend: Unauthorized file manipulation via improper task state validation CVE-2026-106501 — @backstage/plugin-scaffolder-backend: Backstage: Sensitive information exposure in Scaffolder CVE-2026-106503 — plugin-scaffolder-backend: plugin-scaffolder-backend: Authorization bypass via scaffolder action inputs CVE-2026-109383 — undici: undici: Certificate validation bypass via dropped TLS options in Agent CVE-2026-109829 — undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching CVE-2026-109841 — undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens CVE-2026-109869 — undici: undici: Denial of Service via unhandled stream error on excessive content encodings CVE-2026-109924 — undici: undici: Denial of Service via memory exhaustion in EventSource client CVE-2026-109932 — undici: undici: Denial of Service via unbounded WebSocket PONG buffering CVE-2026-111497 — brotli: Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111758 — markdown-it: markdown-it: Denial of Service via unclosed link reference definitions CVE-2026-111759 — markdown-it: markdown-it: Denial of Service via mismatched quote parsing CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates CVE-2026-113872 — multer: multer: Denial of Service via aborted request during asynchronous file filtering CVE-2026-114406 — ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-116576 — systeminformation: systeminformation: Command injection via improper quotation mark sanitization

🎯 Affected products6

  • Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:d2b0d41a3ea3cd8978cdd706628834274fbcde3930e94ea24bd0039830f27d32_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:490a4af0b621d57feaf880a7475e69c42daaa3fb03370e02745874ee73866c30_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:678190bb06b817aa80ccfb9a1d1c92564e9d1044cdb1650b299ae719d16bcdee_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:1c60236a1acfc0845f4b4fed0fba43ef3e82ee310d8f4ed4d5007e1816a4316c_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:26626a0359a923036061b3cd91a07da3a487d07006e446f63a090a5033bb1a91_amd64 as a component of Red Hat Developer Hub 1.10

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce the risk associated with this flaw: 1. Restrict template access: Limit permissions to execute Scaffolder templates to trusted users by configuring role-based access control (RBAC) policies in Red Hat Developer Hub or Ansible Automation Platform. 2. Enforce least privilege on integration credentials: Audit and restrict source control provider tokens (such as GitHub, GitLab, or Bitbucket credentials) to the minimum necessary repository scopes and permissions required for legitimate template actions. Caveats: Limiting integration credential permissions may cause templates that require administrative or elevated privileges to fail. Modifying credential secrets or configuration files within the deployment environment will require restarting the application pods for the new settings to take effect. Workaround: See the security bulletin for a detailed mitigation procedure. Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to disable the markdown-it reference block rule or avoid lazy string concatenation during multi-line link reference parsing: upgrade to markdown-it 14.3.3 and 15.0.3 (or the fixed Libgit/Forgejo/Ansible/Libgit2/Nextcloud/Markdownlint Cli/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhdh/Rhdh Hub Rhel/Devspaces/Code Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Thrift/Ansible Automation Platform/Automation Portal/Rhoai/Odh Feature Server Rhel/Rhdh/Red Hat Developer Hub Backstage Plugin Orchestrator Backend/Ansible Automation Platform/Bootc Automation Portal Rhel/Rh Podman Desktop/Rhdh/Red Hat Developer Hub Backstage Plugin Lightspeed Backend/Redhat User Workloads/Mintmaker Renovate Image builds), which scan the source string directly by index position and enforce a 999-character limit on reference labels instead of lazily concatenating continuation lines, closing all 2 injection vectors (crafted multi-line unclosed link reference label, crafted multi-line unclosed link reference title). Until patched, this is a concern on applications parsing untrusted user-supplied Markdown with the reference block rule enabled, so disable the reference rule via configuration or restrict untrusted user Markdown input parsing. As a compensating measure, set per-process CPU time limits via RLIMIT_CPU to bound excessive processing time from quadratic string flattening and apply rate limiting and connection throttling to restrict repeated parsing requests. These controls limit blast radius and contain exploitation, but they do not fix the underlying quadratic cons-string flattening defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high) Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to disable typographer mode or the smartquotes inline rule across all markdown-it instances processing untrusted user input: upgrade to markdown-it 14.3.2 and 15.0.2 (or the fixed Libgit/Libgit2/Nextcloud/Forgejo/Ansible/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhdh/Rhdh Hub Rhel/Devspaces/Code Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Thrift/Ansible Automation Platform/Automation Portal/Rhoai/Odh Feature Server Rhel/Rhdh/Red Hat Developer Hub Backstage Plugin Orchestrator Backend/Ansible Automation Platform/Bootc Automation Portal Rhel/Rh Podman Desktop/Rhdh/Red Hat Developer Hub Backstage Plugin Lightspeed Backend/Redhat User Workloads/Mintmaker Renovate Image builds), which track latest single and double quote openers directly using head pointers and cap the quote opener stack at 1,000 items, closing crafted Markdown with numerous opening quotes followed by mismatched closing quotes. Until patched, this is a concern on applications and services parsing untrusted Markdown with typographer mode or smartquotes enabled, so disable the typographer configuration option or explicitly disable the smartquotes rule in all markdown-it parser instances accepting user-supplied content. As a compensating measure, enforce RLIMIT_CPU limits on parser worker processes to bound maximum CPU time consumption, configure systemd watchdog monitoring and automatic restart directives to recover stalled parser processes, restrict the maximum character length and token count of accepted Markdown input, constrain CPU quotas using cgroups v2 to contain the blast radius of parser CPU exhaustion, and throttle incoming HTTP request rates and connections on endpoints accepting Markdown payloads. These controls limit blast radius and contain exploitation, but they do not fix the underlying quadratic quote rescanning complexity defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high) Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to avoid shell invocation or enforce strict character allowlists before passing service names to PowerShell within systeminformation: upgrade to systeminformation 5.33.16 (or the corresponding fixed Red Hat builds), which remove Unicode quotation marks and dashes in sanitizeShellString() and enforce an allowed character whitelist for service names on Windows, closing all 2 injection vectors (crafted service names with Unicode quotation marks, PowerShell filter string termination). Until patched, this is only a concern on Windows systems hosting Node.js applications that forward untrusted input to services() or getDynamicData() — Red Hat Enterprise Linux environments, Linux, and macOS deployments are unaffected — so Audit and restrict application entry points to prevent untrusted input from reaching services() or getDynamicData(), or reject inputs containing non-ASCII characters and quotes. As a compensating measure, Sanitize downstream PowerShell argument and filter delimiters in user input prior to CLI command execution, Enforce Windows Defender Application Control in enforced mode with PowerShell Constrained Language Mode to block unauthorized binaries and commands an injected expression might run, and Deploy EDR agents to detect anomalous child process execution and suspicious PowerShel…

🔗 References (29)