RHSA-2026:88198HighCVSS 7.5

Red Hat Security Advisory: Red Hat Developer Hub 1.10.6 release.

Published
October 22, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (5)

CVE-2026-84782 →CVE-2026-90711 →CVE-2026-93748 →CVE-2026-93749 →CVE-2026-101916 →

📋 Description

CVE-2026-84782 — openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission CVE-2026-90711 — proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet CVE-2026-93748 — http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive CVE-2026-93749 — source-map-js: source-map-js: Denial of Service via malformed indexed source maps CVE-2026-101916 — grpc-js: grpc-js: Authentication bypass via improper peer certificate validation

🎯 Affected products6

  • Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64 as a component of Red Hat Developer Hub 1.10

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: To mitigate this flaw through configuration: 1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation. 2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`). 3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications. Warning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (21)