RHSA-2026:93987HighCVSS 9.0

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.2 Release.

Published
November 2, 2026
Last Modified
November 4, 2026

🔗 CVE IDs covered (2)

CVE-2025-12999 →CVE-2026-111497 →

📋 Description

CVE-2025-12999 — openvsx: openvsx-server: Arbitrary code execution via HTTP cache poisoning CVE-2026-111497 — brotli: Out-of-Bounds Write in Google Brotli Decoder

🎯 Affected products62

  • Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-rhel9@sha256:0e3e9a41db1e015345046b22f6a6c54d6d50582dadcda6cc08fdb36842afc372_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-rhel9@sha256:6d3a9cbd9c4a3924223b10343678fa6398d69cabf0b1a170bc59466ad43080e2_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-rhel9@sha256:e1117d8f4d3f40adea517ac74b3b0da9e86983b7aa53b513cb754ac2227f0ccc_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-rhel9@sha256:f67d4763c6c944a57860787be7098d0fd56200abe5ca95b2e29d4c934e03cc6e_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:290a81eb8be15702bd5018ad10a50e92cbdb062c00c42379dbbd5ca77dbf9781_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:415a3c0c74b66d9d8da4984fe2681d5574683720fccd1fcfd3390d3e10bdde40_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:784bd21f79e4a196c57c6fa1e012cbff6e2780c347b2244e40414bc8fb695f79_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/code-sshd-rhel9@sha256:8fe34b04ae0d2e987a2f30bfbe53548856bbd94cd28e7221c82e8ed5fb42babd_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:4724643d443fe31e04a686663da388428d1b8778d37062bfecd8f591fc4bd4a5_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:670c02e62049a3f3c0e47993dc6fd673bd63e3d5879fa817535a072d9a458c98_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:a57f60ff471ec96afb87e9e053b78a504ad033a43cc99f77505cdfc9835f40e6_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/configbump-rhel9@sha256:c4133b3ea98c67a87d83fdca73097b50f3b27f79fd3af4ba7110cea3892c9a21_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:19a43008e9776fff36f2cf63b706512bf24dd55da5f0ca7abee52dcfa8d9b743_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:20f2171ae44330eda9ac396fadbd2cab301199561d83274566ea309e303120c4_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:50294dfb751efde199072408027958abe028cf13b7b978c0e2b9b5df2eeee895_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/dashboard-rhel9@sha256:a5e84f07cf284fcbdd00f741304dcb7bb7508711c650e4ecb8c2273570c61e0b_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:c8a4d42856990e5b5046797aba06b95a6bc758976ed4529bff2d69edd4e2c23d_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:190e4402c4bb91c64bfd67271e50da55b43e79bb0b91a5ce63ba0983dc6e107a_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:6bd7d48bb10a67823d98a8cbda79600e31d3738660e4ed2b76c85213ec3d2403_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:84df9b36d22e3f66dfbc2178a682c047813b36aa017ed897e46b26edaac1085e_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:ba080acda238e21b0dc763cf96c413189239862243b58632fe47f5f08e79f806_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:18a53f8b50dc01f944fe7082a418121a876e61412b2f22ec9ea01351ea15dde9_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:48473f30cee58561083adf89c3141df0bd943e067ccd00199dffe5c05cebd96b_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:b4d94efbae36912896539330f6be84341075439f0cbba8df5b8a29f664f586d8_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/imagepuller-rhel9@sha256:cb0f39f467cc4bc143644eb9c47875a72a26bc92242601056198bf45058a028c_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0b4a3268d54b6758c1150806ea1a504b307716fcb3c73acfaafcc68ee91dbde5_amd64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:3d85d24fcf983833e9750a5c903f1f09fc31022c0966d551e4489e20459ba155_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:59cd73b9cce6a5f5b95efc4793f546387d779959cfcc3d3f596e6f05c2f56f14_arm64 as a component of Red Hat OpenShift Dev Spaces 3.31
  • registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7fd2d21d5e5bbc133e12a10d628276f9d9eb7dbfc8c30d029f21e07278cdcb23_s390x as a component of Red Hat OpenShift Dev Spaces 3.31
  • +32 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: On installations that cannot upgrade to a fixed version yet, reconfigure the proxy in front of the Open VSX server to set X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix to known values instead of relaying client input, and make sure the server is not reachable except through that proxy. Existing poisoned cache entries survive the configuration change, so flush the Open VSX caches afterwards. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (5)