RHSA-2026:90388HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 26, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (10)

CVE-2026-110306 →CVE-2026-110725 →CVE-2026-110816 →CVE-2026-65627 →CVE-2026-100354 →CVE-2026-110180 →CVE-2026-111181 →CVE-2026-100352 →CVE-2026-100353 →CVE-2026-110095 →

📋 Description

CVE-2026-65627 — jose: jose: Denial of Service via unbounded decompression of crafted JWE tokens CVE-2026-100352 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via improper handling of non-finite numeric values CVE-2026-100353 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding CVE-2026-100354 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unbounded recursion during schema validation CVE-2026-110095 — fast-uri: fast-uri: Path traversal via improper relative URI normalization CVE-2026-110180 — fast-uri: fast-uri: Security policy bypass via improper host canonicalization CVE-2026-110306 — fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding CVE-2026-110725 — fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths CVE-2026-110816 — qs: qs: Denial of Service via unhandled exception during array serialization CVE-2026-111181 — body-parser: body-parser: Denial of Service via unhandled decompression stream error

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana12.4-0:12.4.13-0.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana12.4-0:12.4.13-0.4.hum1@src as a component of Red Hat Hardened Images
  • grafana12.4-0:12.4.13-0.4.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Reject JWE tokens carrying the "zip": "DEF" header at the application gateway or API perimeter before decryption routines are executed. --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounded decompression during JWE block decryption in jose: upgrade to jose 1.11.13 (or the corresponding fixed Red Hat builds), which perform incremental decompression via zlib:safeInflate/2 and abort with a badarg error if output exceeds a configurable ceiling, closing all 2 injection vectors (crafted JWE token with zip DEF header, DEFLATE decompression bomb). Until patched, this is a concern on applications decrypting JWE tokens using jose, so reject JWE tokens carrying the zip DEF header at the application gateway or API perimeter before decryption routines are executed. As a compensating measure, monitor cgroup memory pressure events and PSI to detect rapid memory spikes and out-of-memory pressure caused by decompression bombs. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded decompression defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium) Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (15)