RHSA-2026:95360HighCVSS 8.1

Red Hat Security Advisory: Red Hat build of Cryostat security update

Published
November 4, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (20)

CVE-2026-82417 →CVE-2026-88031 →CVE-2026-102276 →CVE-2026-49978 →CVE-2026-56862 →CVE-2026-78669 →CVE-2026-83663 →CVE-2026-106445 →CVE-2026-106446 →CVE-2026-39834 →CVE-2026-46603 →CVE-2026-46604 →CVE-2026-56858 →CVE-2026-84445 →CVE-2026-90711 →CVE-2026-91135 →CVE-2026-94637 →CVE-2026-102278 →CVE-2026-33818 →CVE-2026-59879 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-46603 — golang.org/x/image/vp8l: golang.org/x/image/vp8l: Denial of Service via excessive memory allocation CVE-2026-46604 — golang.org/x/image/tiff: golang.org/x/image/tiff: Denial of Service via invalid TIFF image CVE-2026-49978 — dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-59879 — immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-82417 — qs: qs: Denial of Service via improper validation in stringify function CVE-2026-83663 — github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs CVE-2026-90711 — proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet CVE-2026-91135 — thrift: Apache Thrift: Arbitrary code execution via heap-based buffer overflow during frame compression CVE-2026-94637 — github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of compressed data CVE-2026-102276 — brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns CVE-2026-102278 — brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns CVE-2026-106445 — handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106446 — handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

🎯 Affected products21

  • Cryostat 4 on RHEL 9
  • cryostat/cryostat-agent-init-rhel9@sha256:70670befce83fe0b5c952944f3ce605cd28dd2748ee684457ef4ace109ee574b_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-agent-init-rhel9@sha256:dd5223d7e14825ce9a763e5897c590d81ad7628d39d5df32a83525eed4a7eaaf_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-db-rhel9@sha256:03cfb6cf1c6f79d972e3e60ec8253e284673429bce9d51e42031efe6c109fc5b_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-db-rhel9@sha256:f55f9d56d92278721078e2e30fb2bbb6fe37c13ef7ba889e97c52fb7cf7e305d_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-grafana-dashboard-rhel9@sha256:72044555bcb7c9f99fccb9295216358eedbd35cb1af93619a23def2f8781e21f_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-grafana-dashboard-rhel9@sha256:b4e295b5e8244f1eec07302bbdf180d00939350e2812d43a812482a72a39727d_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-openshift-console-plugin-rhel9@sha256:cc675e69e1dd2824967a36391a252a1eba48a7d40a0e7147cc000925d6ff15b2_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-openshift-console-plugin-rhel9@sha256:f84432eb24357082edf7a0bbff2cdf196e9ff63200d230a135704156c8529c05_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-operator-bundle@sha256:5cc69c73aec0b1bf41c5463bb301c3c8ca3e92a6692f1c3033dab457d540541f_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-operator-bundle@sha256:a888454a617e9bc4da0576910e5e427f8402b7c81c1544f42a314bf1336d9c39_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-reports-rhel9@sha256:38fbd37ac48a98540273b354294e7ba08fa3cbbf5914a66fb563ed96f53ef681_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-reports-rhel9@sha256:7ba11260b30778522542660ae262a22d5aac59a34c8c29286ead4535720652cc_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9-operator@sha256:1af2938db225959f0672150b999fd6b43f11db48db16651ec395dca304830063_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9-operator@sha256:9fd13fcc7d3b038b4afe04fa488e7e9e8dfb23398d445bb5571401eecb1848ef_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9@sha256:83a69191d356f8f87b5bd2e13a2e091f083b61ed6ed08a1f67c0f54426654c3e_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-rhel9@sha256:e87002a807cb976da35bf8d7fa34983164263228eb633204059edf28846f2b85_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-storage-rhel9@sha256:f694d48d0ce96693e87760c26436c5f60888002aeb4c9cb8276a70cc87aa42f2_arm64 as a component of Cryostat 4 on RHEL 9
  • cryostat/cryostat-storage-rhel9@sha256:f7bfbf90b0dac7cb87324fb22c132d7dce437516be2a46debde536647b907f7b_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/jfr-datasource-rhel9@sha256:c8cf4acf7a6fc1f858e8785dafd5cb3d103f0ed6db49151101d0746001719e6f_amd64 as a component of Cryostat 4 on RHEL 9
  • cryostat/jfr-datasource-rhel9@sha256:cca5ede1948dcb81597f269b99ccca83a13725e356e04e2007e001c05ddfa567_arm64 as a component of Cryostat 4 on RHEL 9

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: There is no complete inline mitigation for this issue; the fix requires upgrading golang.org/x/image to version 0.43.0 or later, which validates the strip offset before use. Where an immediate upgrade is not possible, exposure can be reduced by not decoding untrusted or externally supplied TIFF images, or by isolating TIFF decoding in a sandboxed, restartable worker process so a panic does not crash the primary service. Workaround: To mitigate this issue, applications should implement input validation to reject or clamp any externally supplied List index or key-path segment that exceeds a sane maximum, specifically values greater than or equal to 2^30. Additionally, running request handling in isolated worker processes with capped heap sizes (e.g., using `--max-old-space-size`) can contain the impact of a potential process abort. Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: If an immediate upgrade to qs 6.16.0 is not feasible, avoid re-serializing attacker-influenced parsed query or body objects with qs.stringify. Where qs.parse is used directly, set allowPrototypes: false unless prototype keys are required. For Express applications, review whether the default query parser configuration is necessary. Wrapping qs.stringify calls in try/catch can limit impact to individual requests. Workaround: If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure: - Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection. - Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.). Workaround: To mitigate this flaw through configuration: 1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation. 2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`). 3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications. Warning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections. Workaround: Do not set allowProtoMethodsByDefault to true when compiling or rendering untrusted templates or untrusted data. Workaround: Upgrade to Handlebars 4.7.10 or later. Ensure only strings are passed to Handlebars.compile() and Handlebars.precompile(); reject non-string inputs. If templates are precompiled at build time, prefer the runtime-only build (handlebars/runtime) so compile() is unavailable on the server.

🔗 References (23)