RHSA-2026:66008
Vulnerability from csaf_redhat - Published: 2026-09-09 13:42 - Updated: 2026-09-11 15:49Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
grafana12.4:
* grafana12.4-12.4.10-0.2.hum1 (aarch64, x86_64)
* grafana12.4-12.4.10-0.2.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
On instances using Auth Proxy header authentication ([auth.proxy]) with identity caching enabled (sync_ttl > 0), two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged user's cached session and act as that user for the duration of the cache TTL. Default configurations are not affected.
7.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici's retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to pending promises and streams accumulating, which can exhaust application resources and result in a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-14199
Threats
Impact
Moderate
A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an application relaying such a response to a downstream HTTP/1.1 peer without proper framing normalization may enable HTTP response splitting or desynchronization, allowing an attacker to inject arbitrary content into subsequent responses.
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')Affected products
Fixed
3 products, the same list as for
CVE-2026-14199
Threats
Impact
Low
A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).
7.5 (High)
Affected products
Fixed
3 products, the same list as for
CVE-2026-14199
Threats
Impact
Important
A flaw in Grafana's public dashboard deletion endpoint lacks organization isolation, allowing an Organization Administrator to delete public dashboards in other organizations using the target dashboard's ID.
CWE-1220 - Insufficient Granularity of Access ControlAffected products
Fixed
3 products, the same list as for
CVE-2026-14199
Threats
Impact
Low
A flaw was found in undici. The decompress interceptor in undici processes compressed response bodies based on the untrusted Content-Encoding header. A remote attacker can exploit this by sending a small, specially crafted compressed payload, known as a 'compression bomb,' which expands significantly in client memory. This unbounded decompression can lead to memory exhaustion and cause the application to crash, resulting in a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-14199
Threats
Impact
Moderate
A flaw was found in undici. The software's caching mechanism, when operating in shared cache mode, improperly stores responses that include 'Set-Cookie' headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one user can be inadvertently disclosed to another user accessing the same cached content.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-14199
Threats
Impact
Moderate
A flaw was found in undici, a Node.js HTTP/1.1 client. When the dump interceptor processes oversized chunked responses that do not declare a Content-Length, it prematurely signals completion. This causes the application to receive an incomplete or empty response body, while the network connection is unexpectedly closed. This issue can lead to applications processing partial data or encountering unexpected connection disruptions.
6.5 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-14199
Threats
Impact
Moderate
A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.
7.4 (High)
Affected products
Fixed
3 products, the same list as for
CVE-2026-14199
Threats
Impact
Important
A flaw was found in undici. The cache interceptor incorrectly caches responses to unsafe HTTP methods, such as POST, PUT, or DELETE. A remote attacker can exploit this by providing a cacheable response, leading to subsequent state-changing requests being served from a stale cache entry without reaching the origin. This can result in an integrity failure, where the client's application state is not updated as expected.
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')Affected products
Fixed
3 products, the same list as for
CVE-2026-14199
Threats
Impact
Low
A flaw was found in undici's experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service (DoS) by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the termination of the entire Node.js process.
5.9 (Medium)
Affected products
Fixed
3 products, the same list as for
CVE-2026-14199
Threats
Impact
Moderate
References
72 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ngrafana12.4:\n * grafana12.4-12.4.10-0.2.hum1 (aarch64, x86_64)\n * grafana12.4-12.4.10-0.2.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:66008",
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84961",
"url": "https://access.redhat.com/security/cve/CVE-2026-84961"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19534",
"url": "https://access.redhat.com/security/cve/CVE-2026-19534"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-18540",
"url": "https://access.redhat.com/security/cve/CVE-2026-18540"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84933",
"url": "https://access.redhat.com/security/cve/CVE-2026-84933"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-18149",
"url": "https://access.redhat.com/security/cve/CVE-2026-18149"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84947",
"url": "https://access.redhat.com/security/cve/CVE-2026-84947"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85008",
"url": "https://access.redhat.com/security/cve/CVE-2026-85008"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84890",
"url": "https://access.redhat.com/security/cve/CVE-2026-84890"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85014",
"url": "https://access.redhat.com/security/cve/CVE-2026-85014"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14199",
"url": "https://access.redhat.com/security/cve/CVE-2026-14199"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-28378",
"url": "https://access.redhat.com/security/cve/CVE-2026-28378"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19197",
"url": "https://access.redhat.com/security/cve/CVE-2026-19197"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66008.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-09-11T15:49:26+00:00",
"generator": {
"date": "2026-09-11T15:49:26+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.20"
}
},
"id": "RHSA-2026:66008",
"initial_release_date": "2026-09-09T13:42:29+00:00",
"revision_history": [
{
"date": "2026-09-09T13:42:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-09T17:08:02+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-11T15:49:26+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12-4-main@aarch64",
"product": {
"name": "grafana12-4-main@aarch64",
"product_id": "grafana12-4-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.10-0.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12-4-main@src",
"product": {
"name": "grafana12-4-main@src",
"product_id": "grafana12-4-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.10-0.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12-4-main@x86_64",
"product": {
"name": "grafana12-4-main@x86_64",
"product_id": "grafana12-4-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.10-0.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12-4-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12-4-main@aarch64"
},
"product_reference": "grafana12-4-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12-4-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12-4-main@src"
},
"product_reference": "grafana12-4-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12-4-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12-4-main@x86_64"
},
"product_reference": "grafana12-4-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-14199",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"discovery_date": "2026-08-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521850"
}
],
"notes": [
{
"category": "description",
"text": "On instances using Auth Proxy header authentication ([auth.proxy]) with identity caching enabled (sync_ttl \u003e 0), two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged user\u0027s cached session and act as that user for the duration of the cache TTL. Default configurations are not affected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: Grafana: Session takeover via Auth Proxy cache key collision",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14199"
},
{
"category": "external",
"summary": "RHBZ#2521850",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521850"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14199"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14199",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14199"
},
{
"category": "external",
"summary": "https://grafana.com/security/security-advisories/cve-2026-14199/",
"url": "https://grafana.com/security/security-advisories/cve-2026-14199/"
}
],
"release_date": "2026-09-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Set [auth.proxy] sync_ttl = 0 to disable the identity cache (identity is then synced on every request), or upgrade to a fixed version: 11.0.0+, 12.4.10+ (12.4.x), 13.0.8+ (13.0.x), 13.1.5+ (13.1.x), or 13.2.1+ (13.2.x and newer \u2014 13.2.0 itself is still vulnerable).",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "grafana: Grafana: Session takeover via Auth Proxy cache key collision"
},
{
"cve": "CVE-2026-18149",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"discovery_date": "2026-09-04T17:34:19.339068+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528802"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici\u0027s retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to pending promises and streams accumulating, which can exhaust application resources and result in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service due to orphaned response body in retry handler",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An attacker-controlled server can trigger a denial of service in applications using undici\u0027s retry handler. This vulnerability allows for resource exhaustion by leaving response bodies orphaned, which can lead to a degradation of service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18149"
},
{
"category": "external",
"summary": "RHBZ#2528802",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528802"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18149"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x"
}
],
"release_date": "2026-09-04T17:21:46.263000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Applications utilizing undici should implement an independent request deadline and ensure the response body is explicitly destroyed upon expiration. The bodyTimeout mechanism alone is insufficient to prevent resource exhaustion in this scenario.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Denial of Service due to orphaned response body in retry handler"
},
{
"cve": "CVE-2026-18540",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-04T17:26:35.687862+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an application relaying such a response to a downstream HTTP/1.1 peer without proper framing normalization may enable HTTP response splitting or desynchronization, allowing an attacker to inject arbitrary content into subsequent responses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: HTTP response splitting via retry interceptor",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Low impact flaw in the undici HTTP client\u0027s retry interceptor can lead to HTTP response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards responses without proper framing normalization.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18540"
},
{
"category": "external",
"summary": "RHBZ#2528783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18540"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18540",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18540"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"
}
],
"release_date": "2026-09-04T17:15:50.619000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Disable interceptors.retry() for untrusted upstreams, or set maxRetries: 0 on the retry interceptor configuration. Alternatively, remove or recalculate the Content-Length header before forwarding a response body assembled by undici to downstream HTTP/1.1 peers.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "undici: undici: HTTP response splitting via retry interceptor"
},
{
"cve": "CVE-2026-19534",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-09-04T17:21:01.599799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unrequested WebSocket subprotocol",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in undici\u0027s WebSocket client, which can lead to a Node.js process crash. The vulnerability is triggered when an application connects to a malicious or compromised server that responds with an unrequested WebSocket subprotocol, allowing a remote, unauthenticated attacker to cause a denial of service in affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19534"
},
{
"category": "external",
"summary": "RHBZ#2528759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19534"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"
}
],
"release_date": "2026-09-04T17:10:05.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via unrequested WebSocket subprotocol"
},
{
"cve": "CVE-2026-28378",
"cwe": {
"id": "CWE-1220",
"name": "Insufficient Granularity of Access Control"
},
"discovery_date": "2026-07-07T22:01:47.475071+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497887"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in Grafana\u0027s public dashboard deletion endpoint lacks organization isolation, allowing an Organization Administrator to delete public dashboards in other organizations using the target dashboard\u0027s ID.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: Grafana: Unauthorized public dashboard deletion across organizations",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Low impact flaw in Grafana allows an authenticated Organization Administrator to delete public dashboards belonging to other organizations. This is due to insufficient isolation enforcement in the public dashboard deletion endpoint, potentially affecting the availability of dashboards in multi-organizational Grafana deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-28378"
},
{
"category": "external",
"summary": "RHBZ#2497887",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497887"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-28378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28378"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28378",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28378"
},
{
"category": "external",
"summary": "https://grafana.com/security/security-advisories/cve-2026-28378",
"url": "https://grafana.com/security/security-advisories/cve-2026-28378"
}
],
"release_date": "2026-07-07T21:08:04.579000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Since this vulnerability only affects the Public Dashboards feature, environments that do not utilize public dashboards can completely neutralize the risk by disabling the feature. This removes the vulnerable endpoint from the attack surface entirely.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "grafana: Grafana: Unauthorized public dashboard deletion across organizations"
},
{
"cve": "CVE-2026-84890",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-09-04T17:23:53.949898+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528772"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. The decompress interceptor in undici processes compressed response bodies based on the untrusted Content-Encoding header. A remote attacker can exploit this by sending a small, specially crafted compressed payload, known as a \u0027compression bomb,\u0027 which expands significantly in client memory. This unbounded decompression can lead to memory exhaustion and cause the application to crash, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unbounded decompression of compressed responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The undici library, used in some Red Hat products, is vulnerable to a denial of service. This occurs when processing untrusted compressed HTTP responses, which can lead to unbounded memory consumption and application crashes. The Moderate severity is due to the requirement of a malicious or faulty upstream server to deliver a specially crafted \u0027compression bomb\u0027 payload.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84890"
},
{
"category": "external",
"summary": "RHBZ#2528772",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528772"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84890"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84890",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84890"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm"
}
],
"release_date": "2026-09-04T17:04:28.261000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Denial of Service via unbounded decompression of compressed responses"
},
{
"cve": "CVE-2026-84933",
"cwe": {
"id": "CWE-524",
"name": "Use of Cache Containing Sensitive Information"
},
"discovery_date": "2026-09-04T17:10:59.058130+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. The software\u0027s caching mechanism, when operating in shared cache mode, improperly stores responses that include \u0027Set-Cookie\u0027 headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one user can be inadvertently disclosed to another user accessing the same cached content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Cross-user cookie disclosure via Set-Cookie caching",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw affects applications that use undici\u0027s shared-cache interceptor (interceptors.cache(), type: \u0027shared\u0027, which is the default) against untrusted or multi-tenant upstream servers. In that configuration, undici stores and re-serves the Set-Cookie header of cached responses, allowing one user\u0027s session cookie to be disclosed to another caller that hits the same cache key, and allowing a malicious upstream to inject cookies into responses served to other users. Applications that only use undici as an HTTP client without enabling the shared cache interceptor, or that only use the private cache mode, are not affected. Red Hat products that bundle undici versions prior to 7.0.0 (5.x/6.x lines) are not affected, as the vulnerable cache interceptor was introduced in undici 7.0.0.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84933"
},
{
"category": "external",
"summary": "RHBZ#2528756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84933"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84933",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84933"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j"
}
],
"release_date": "2026-09-04T16:59:08.807000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Upgrade to undici 7.29.1 or 8.10.2 (or later), where the shared cache interceptor no longer stores or re-serves responses containing Set-Cookie. Where an immediate upgrade is not possible: use a private cache (type: \u0027private\u0027) for per-user responses instead of the shared cache; avoid caching responses that carry a Set-Cookie header; or, if your service itself acts as a shared cache in front of an untrusted origin, strip Set-Cookie from upstream responses before caching them.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Cross-user cookie disclosure via Set-Cookie caching"
},
{
"cve": "CVE-2026-84947",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"discovery_date": "2026-09-04T17:01:36.613728+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528754"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici, a Node.js HTTP/1.1 client. When the dump interceptor processes oversized chunked responses that do not declare a Content-Length, it prematurely signals completion. This causes the application to receive an incomplete or empty response body, while the network connection is unexpectedly closed. This issue can lead to applications processing partial data or encountering unexpected connection disruptions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: Undici: Response truncation and connection termination",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84947"
},
{
"category": "external",
"summary": "RHBZ#2528754",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528754"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84947"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968"
}
],
"release_date": "2026-09-04T16:53:11.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: Undici: Response truncation and connection termination"
},
{
"cve": "CVE-2026-84961",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-09-04T16:52:40.440125+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528735"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici\u0027s BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw only affects applications that construct an undici BalancedPool with a function-valued connect or tls option \u2014 for example, a custom checkServerIdentity callback or connector used for certificate pinning across multiple upstreams. Client, Pool, Agent, and RoundRobinPool destructure these options before the internal JSON-based clone and are not affected. An attacker able to present, on the network path, a TLS endpoint whose certificate the application\u0027s custom validator was written to reject \u2014 but which still satisfies Node.js\u0027s default hostname and chain checks \u2014 can have that certificate silently accepted when the connection goes through BalancedPool, enabling a man-in-the-middle attack against affected connections.\nThis affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84961"
},
{
"category": "external",
"summary": "RHBZ#2528735",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528735"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84961"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84961",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84961"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3"
}
],
"release_date": "2026-09-04T16:47:55.724000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Applications that do not use BalancedPool, or that use it without a custom function-valued connect/tls option, are not affected and require no action. As a workaround until packages are updated, avoid using BalancedPool for any connection that relies on custom TLS certificate validation (e.g. certificate pinning); use Client, Pool, or Agent instead, which are unaffected. The permanent fix is upgrading undici to 7.29.1 or later (7.x line) or 8.10.2 or later (8.x line).",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options"
},
{
"cve": "CVE-2026-85008",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-04T16:55:29.468757+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528747"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. The cache interceptor incorrectly caches responses to unsafe HTTP methods, such as POST, PUT, or DELETE. A remote attacker can exploit this by providing a cacheable response, leading to subsequent state-changing requests being served from a stale cache entry without reaching the origin. This can result in an integrity failure, where the client\u0027s application state is not updated as expected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Integrity failure due to caching of unsafe HTTP method responses",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85008"
},
{
"category": "external",
"summary": "RHBZ#2528747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85008",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85008"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85008",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85008"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv"
}
],
"release_date": "2026-09-04T16:42:40.780000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "undici: undici: Integrity failure due to caching of unsafe HTTP method responses"
},
{
"cve": "CVE-2026-85014",
"cwe": {
"id": "CWE-390",
"name": "Detection of Error Condition Without Action"
},
"discovery_date": "2026-09-04T16:41:09.987760+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528712"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici\u0027s experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service (DoS) by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the termination of the entire Node.js process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via WebSocketStream unclean close",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in the `undici` library\u0027s experimental `WebSocketStream` client can lead to a denial of service. An untrusted remote server can crash a vulnerable Node.js client application by abruptly closing a TCP connection without a WebSocket handshake. This affects the availability of applications utilizing `undici` in Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85014"
},
{
"category": "external",
"summary": "RHBZ#2528712",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528712"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85014"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85014",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85014"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq"
}
],
"release_date": "2026-09-04T16:30:07.996000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Denial of Service via WebSocketStream unclean close"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…