RHSA-2026:93951HighCVSS 8.1

Red Hat Security Advisory: OpenShift Virtualization v4.17 Images

Published
November 2, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (3)

CVE-2026-9277 →CVE-2026-59879 →CVE-2026-84375 →

📋 Description

CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-59879 — immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

🎯 Affected products3

  • Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:bd715a80bbad560d843f487ef602ecbc7fdb1928a44aed61de9abc3f8f1b10fd_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:c2e57c0966b64bd029e801628e7b14ee4f4b5c153ec1dfa33d633e42c4a09468_amd64 as a component of Red Hat Container Native Virtualization 4.17

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, applications should implement input validation to reject or clamp any externally supplied List index or key-path segment that exceeds a sane maximum, specifically values greater than or equal to 2^30. Additionally, running request handling in isolated worker processes with capped heap sizes (e.g., using `--max-old-space-size`) can contain the impact of a potential process abort.

🔗 References (6)