RHSA-2026:10175HighCVSS 9.8

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.1 Release.

Published
April 23, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (25)

CVE-2026-33939 →CVE-2026-33941 →CVE-2026-34986 →CVE-2025-61728 →CVE-2026-22731 →CVE-2026-25679 →CVE-2026-27137 →CVE-2026-29054 →CVE-2026-40175 →CVE-2026-2332 →CVE-2026-4926 →CVE-2026-33433 →CVE-2026-33870 →CVE-2026-33871 →CVE-2026-33937 →CVE-2026-33938 →CVE-2026-26999 →CVE-2026-33186 →CVE-2026-33805 →CVE-2026-33940 →CVE-2025-62718 →CVE-2026-4800 →CVE-2026-27606 →CVE-2026-32305 →CVE-2026-32695 →

📋 Description

CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-2332 — org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-4926 — path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions CVE-2026-22731 — Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-26999 — github.com/traefik/traefik: Traefik: Denial of Service due to incomplete TLS handshake CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27606 — rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability CVE-2026-29054 — github.com/traefik/traefik: Traefik: Information disclosure due to case-insensitive Connection header processing CVE-2026-32305 — Traefik: github.com/traefik/traefik: Traefik: mTLS bypass allows unauthorized service access via fragmented ClientHello. CVE-2026-32695 — github.com/traefik/traefik: Traefik: Cross-tenant traffic exposure and host restriction bypass via rule-syntax injection in Knative provider CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33433 — github.com/traefik/traefik: Traefik: Authentication bypass via non-canonical HTTP header injection CVE-2026-33805 — @fastify/reply-from: @fastify/http-proxy: Fastify Reply From and HTTP Proxy: Security bypass via Connection header manipulation CVE-2026-33870 — io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values CVE-2026-33871 — netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood CVE-2026-33937 — handlebars.js: Handlebars: Remote Code Execution via crafted Abstract Syntax Tree object in compile() CVE-2026-33938 — handlebars: Handlebars: Arbitrary code execution via @partial-block overwrite CVE-2026-33939 — handlebars.js: Handlebars.js: Denial of Service via malformed decorator syntax in template compilation CVE-2026-33940 — handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context CVE-2026-33941 — handlebars.js: Handlebars: Arbitrary code execution via CLI precompiler input sanitization flaw CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-40175 — axios: Axios: Remote Code Execution via Prototype Pollution escalation

🎯 Affected products62

  • Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27
  • +32 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions. Workaround: To mitigate, ensure that application endpoints requiring authentication are not declared under paths already configured as Health Group additional paths within Spring Boot applications using Actuator. Review and adjust your application's configuration to prevent this overlap. A redeployment of the application is required for changes to take effect. Workaround: To mitigate unauthorized access, restrict network access to the Traefik instance to only trusted clients and networks. Implement firewall rules to limit inbound connections to the ports Traefik listens on for mTLS-protected services. For example, using `firewalld`, specific source IP addresses or networks can be allowed. After applying firewall rules, ensure the firewall service is reloaded for changes to take effect. This reduces the attack surface by preventing untrusted external access to the Traefik instance. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, ensure that any input provided to the `Handlebars.compile()` function is strictly validated to be a string type, preventing the injection of crafted Abstract Syntax Tree (AST) objects. Additionally, for deployments where templates are pre-compiled at build time, consider utilizing the Handlebars runtime-only build (`handlebars/runtime`). This build variant does not include the `compile()` function, thereby eliminating the attack vector. If the application is a service, a restart may be required for the changes to take effect. Workaround: Applications using Handlebars should implement the runtime-only build (`require('handlebars/runtime')`) to prevent exploitation, as this build lacks the vulnerable `compile()` method. Additionally, review all registered helpers to ensure they do not write arbitrary values to context objects, and avoid using third-party helpers in contexts exposed to untrusted input. Workaround: To mitigate this issue, applications utilizing Handlebars.js should implement robust error handling during template compilation and rendering. Specifically, wrap template compilation and rendering calls in `try/catch` blocks to gracefully handle `TypeError` exceptions. Alternatively, validate user-supplied template input to reject decorator syntax (`{{*...}}`) if decorators are not actively used by the application. Employing a pre-compilation workflow, where templates are compiled at build time and only pre-compiled templates are served, can also prevent runtime exploitation. If the application is a service, a restart may be required for changes to take effect. Workaround: To mitigate this issue, use the runtime-only build of Handlebars.js, which prevents the fallback compilation path from being reached. Alternatively, sanitize all context data before rendering to ensure no non-primitive objects are passed to dynamic partials. Avoid dynamic partial lookups (`{{> (lookup ...)}}`) when context data is user-controlled. Implementing these mitigations may require application-level changes. Workaround: To mitigate this issue, ensure all inputs to the Handlebars CLI precompiler are thoroughly validated, rejecting characters with JavaScript string-escaping significance (e.g., \" , \' , ;). For automated build pipelines, configure a fixed and trusted namespace string via a configuration file rather than passing it through command-line arguments. Additionally, consider running the precompiler within a sandboxed environment, such as a container with restricted write access, to limit the potential impact of successful exploitation.

🔗 References (29)