RHSA-2026:74872HighCVSS 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 2, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (11)

CVE-2026-101898 →CVE-2026-101900 →CVE-2026-101904 →CVE-2026-101905 →CVE-2026-101906 →CVE-2026-101908 →CVE-2026-101901 →CVE-2026-101902 →CVE-2026-101903 →CVE-2026-101907 →CVE-2026-101909 →

📋 Description

CVE-2026-101898 — axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings CVE-2026-101900 — axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter CVE-2026-101901 — axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization CVE-2026-101902 — axios: axios: Unintended HTTP method override via prototype pollution gadget CVE-2026-101903 — axios: Axios: Denial of Service via malformed data URLs CVE-2026-101904 — axios: Axios: HTTP header injection via inherited prototype properties CVE-2026-101905 — axios: axios: Request socket hijacking via inherited createConnection property CVE-2026-101906 — axios: axios: Denial of Service via crafted redirect hostname CVE-2026-101907 — axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter CVE-2026-101908 — axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution CVE-2026-101909 — axios: axios: Denial of Service via prototype pollution gadget in form serialization

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana13.2-0:13.2.1-0.9.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana13.2-0:13.2.1-0.9.hum1@src as a component of Red Hat Hardened Images
  • grafana13.2-0:13.2.1-0.9.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/

🔗 References (15)