RHSA-2026:88537HighCVSS 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 23, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (5)

CVE-2026-114125 →CVE-2026-114126 →CVE-2026-65627 →CVE-2026-111755 →CVE-2026-111756 →

📋 Description

CVE-2026-65627 — jose: jose: Denial of Service via unbounded decompression of crafted JWE tokens CVE-2026-111755 — follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering CVE-2026-111756 — follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects CVE-2026-114125 — storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions CVE-2026-114126 — storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token

🎯 Affected products5

  • Red Hat Hardened Images
  • grafana13.1-0:13.1.8-0.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.8-0.4.hum1@s390x as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.8-0.4.hum1@src as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.8-0.4.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Reject JWE tokens carrying the "zip": "DEF" header at the application gateway or API perimeter before decryption routines are executed. --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounded decompression during JWE block decryption in jose: upgrade to jose 1.11.13 (or the corresponding fixed Red Hat builds), which perform incremental decompression via zlib:safeInflate/2 and abort with a badarg error if output exceeds a configurable ceiling, closing all 2 injection vectors (crafted JWE token with zip DEF header, DEFLATE decompression bomb). Until patched, this is a concern on applications decrypting JWE tokens using jose, so reject JWE tokens carrying the zip DEF header at the application gateway or API perimeter before decryption routines are executed. As a compensating measure, monitor cgroup memory pressure events and PSI to detect rapid memory spikes and out-of-memory pressure caused by decompression bombs. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded decompression defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium) Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (9)