RHSA-2026:88198

Vulnerability from csaf_redhat - Published: 2026-10-22 12:08 - Updated: 2026-10-27 04:28
Summary
Red Hat Security Advisory: Red Hat Developer Hub 1.10.6 release.
Severity
Important
Notes
Topic: Red Hat Developer Hub 1.10.6 has been released.
Details: Red Hat Developer Hub (RHDH) is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-84782

A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64 —
Vendor Fix fix
Product Identifier Version Remediation
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64 —
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64 —
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64 —
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64 —
Threats
Impact Important
CVE-2026-90711

A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this vulnerability by submitting a forged X-Forwarded-For header to spoof their client IP address. This flaw allows attackers to bypass IP-based access controls, rate limiting, and audit logging.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-290 - Authentication Bypass by Spoofing
Affected products
Fixed 1 product, the same list as for CVE-2026-84782
Known not affected 4 products, the same list as for CVE-2026-84782
Threats
Impact Important
CVE-2026-93748

A flaw was found in http-cache-semantics. This vulnerability allows unauthenticated attackers to retrieve cached responses, including sensitive session credentials like Set-Cookie values, belonging to other users. This occurs because the component fails to properly validate security-zeroed cache entries when processing client `max-stale` directives. By requesting the same URL with a large `max-stale` value, an attacker can obtain another user's session credentials from shared-cache entries that were intended to be secure.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-524 - Use of Cache Containing Sensitive Information
Affected products
Fixed 1 product, the same list as for CVE-2026-84782
Known not affected 4 products, the same list as for CVE-2026-84782
Threats
Impact Important
CVE-2026-93749

A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service's event loop to block, making it unable to process further requests.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input
Affected products
Fixed 1 product, the same list as for CVE-2026-84782
Known not affected 4 products, the same list as for CVE-2026-84782
Threats
Impact Important
CVE-2026-101916

A flaw was found in grpc-js. In configurations where client certificates are optional, the authentication context lookup fails to distinguish between authorized and unauthorized peer certificates. A remote attacker can exploit this vulnerability by presenting an untrusted certificate, allowing them to bypass authentication mechanisms and access protected services.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 1 product, the same list as for CVE-2026-84782
Known not affected 4 products, the same list as for CVE-2026-84782
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:88198 self
https://access.redhat.com/security/cve/CVE-2026-101916 external
https://access.redhat.com/security/cve/CVE-2026-84782 external
https://access.redhat.com/security/cve/CVE-2026-90711 external
https://access.redhat.com/security/cve/CVE-2026-93748 external
https://access.redhat.com/security/cve/CVE-2026-93749 external
https://access.redhat.com/security/updates/classi… external
https://catalog.redhat.com/search?gs&searchType=c… external
https://developers.redhat.com/rhdh/overview external
https://docs.redhat.com/en/documentation/red_hat_… external
https://redhat.atlassian.net/browse/RHDHBUGS-3767 external
https://redhat.atlassian.net/browse/RHIDP-17177 external
https://redhat.atlassian.net/browse/RHIDP-17303 external
https://redhat.atlassian.net/browse/RHIDP-17316 external
https://redhat.atlassian.net/browse/RHIDP-17321 external
https://redhat.atlassian.net/browse/RHIDP-17745 external
https://redhat.atlassian.net/browse/RHIDP-17746 external
https://redhat.atlassian.net/browse/RHIDP-17747 external
https://redhat.atlassian.net/browse/RHIDP-17748 external
https://redhat.atlassian.net/browse/RHIDP-17749 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-84782 self
https://bugzilla.redhat.com/show_bug.cgi?id=2537080 external
https://www.cve.org/CVERecord?id=CVE-2026-84782 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84782 external
https://openssl-library.org/news/vulnerabilities/… external
https://access.redhat.com/security/cve/CVE-2026-90711 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533602 external
https://www.cve.org/CVERecord?id=CVE-2026-90711 external
https://nvd.nist.gov/vuln/detail/CVE-2026-90711 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/jshttp/proxy-addr/security/adv… external
https://access.redhat.com/security/cve/CVE-2026-93748 self
https://bugzilla.redhat.com/show_bug.cgi?id=2538111 external
https://www.cve.org/CVERecord?id=CVE-2026-93748 external
https://nvd.nist.gov/vuln/detail/CVE-2026-93748 external
https://github.com/kornelski/http-cache-semantics external
https://github.com/kornelski/http-cache-semantics… external
https://github.com/kornelski/http-cache-semantics… external
https://github.com/kornelski/http-cache-semantics… external
https://www.vulncheck.com/advisories/http-cache-s… external
https://access.redhat.com/security/cve/CVE-2026-93749 self
https://bugzilla.redhat.com/show_bug.cgi?id=2538368 external
https://www.cve.org/CVERecord?id=CVE-2026-93749 external
https://nvd.nist.gov/vuln/detail/CVE-2026-93749 external
https://github.com/7rulnik/source-map-js external
https://github.com/7rulnik/source-map-js/blob/c1c… external
https://github.com/7rulnik/source-map-js/issues/76 external
https://www.vulncheck.com/advisories/source-map-j… external
https://access.redhat.com/security/cve/CVE-2026-101916 self
https://bugzilla.redhat.com/show_bug.cgi?id=2542678 external
https://www.cve.org/CVERecord?id=CVE-2026-101916 external
https://nvd.nist.gov/vuln/detail/CVE-2026-101916 external
https://github.com/grpc/grpc-node/commit/2a84ec8b… external
https://github.com/grpc/grpc-node/commit/b4e0079c… external
https://github.com/grpc/grpc-node/releases/tag/@g… external
https://github.com/grpc/grpc-node/security/adviso… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Developer Hub 1.10.6 has been released.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Developer Hub (RHDH) is Red Hat\u0027s enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:88198",
        "url": "https://access.redhat.com/errata/RHSA-2026:88198"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-101916",
        "url": "https://access.redhat.com/security/cve/CVE-2026-101916"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84782",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84782"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-90711",
        "url": "https://access.redhat.com/security/cve/CVE-2026-90711"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-93748",
        "url": "https://access.redhat.com/security/cve/CVE-2026-93748"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-93749",
        "url": "https://access.redhat.com/security/cve/CVE-2026-93749"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh",
        "url": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh"
      },
      {
        "category": "external",
        "summary": "https://developers.redhat.com/rhdh/overview",
        "url": "https://developers.redhat.com/rhdh/overview"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_developer_hub",
        "url": "https://docs.redhat.com/en/documentation/red_hat_developer_hub"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHDHBUGS-3767",
        "url": "https://redhat.atlassian.net/browse/RHDHBUGS-3767"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17177",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17177"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17303",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17303"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17316",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17316"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17321",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17321"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17745",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17745"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17746",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17746"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17747",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17747"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17748",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17748"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17749",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17749"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88198.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Developer Hub 1.10.6 release.",
    "tracking": {
      "current_release_date": "2026-10-27T04:28:19+00:00",
      "generator": {
        "date": "2026-10-27T04:28:19+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:88198",
      "initial_release_date": "2026-10-22T12:08:53+00:00",
      "revision_history": [
        {
          "date": "2026-10-22T12:08:53+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-22T12:08:56+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-27T04:28:19+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Developer Hub 1.10",
                "product": {
                  "name": "Red Hat Developer Hub 1.10",
                  "product_id": "Red Hat Developer Hub 1.10",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhdh:1.10::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Developer Hub"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64",
                  "product_id": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-hub-rhel9@sha256%3Aaf3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9\u0026tag=1792593817"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
                  "product_id": "registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-must-gather-rhel9@sha256%3Ad7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-must-gather-rhel9\u0026tag=1792501528"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64",
                  "product_id": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-rhel9-operator@sha256%3A2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-rhel9-operator\u0026tag=1792594036"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
                  "product_id": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-operator-bundle@sha256%3Aba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-operator-bundle\u0026tag=1792597359"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
                  "product_id": "registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-rag-content-rhel9@sha256%3Ae2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-rag-content-rhel9\u0026tag=1792500854"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-84782",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-18T19:58:21.939000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2537080"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because an unauthenticated network adversary can trigger process crashes or memory exposure without requiring local system privileges. Red Hat Enterprise Linux utilizes OpenSSL as the fundamental cryptographic provider across the operating system; however, overall exposure is limited because the flaw strictly affects software using Datagram Transport Layer Security (DTLS) over UDP under non-blocking I/O configurations. Standard TLS connections over TCP, which represent the typical deployment model for the majority of Red Hat workloads and system services, are unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84782"
        },
        {
          "category": "external",
          "summary": "RHBZ#2537080",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537080"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84782",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84782"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84782",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84782"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782",
          "url": "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782"
        }
      ],
      "release_date": "2026-09-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:08:53+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88198"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission"
    },
    {
      "cve": "CVE-2026-90711",
      "cwe": {
        "id": "CWE-290",
        "name": "Authentication Bypass by Spoofing"
      },
      "discovery_date": "2026-09-15T06:41:11.029083+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533602"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this vulnerability by submitting a forged X-Forwarded-For header to spoof their client IP address. This flaw allows attackers to bypass IP-based access controls, rate limiting, and audit logging.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because unauthenticated remote attackers can spoof client IP addresses and circumvent security controls, such as rate limits or network access lists, by sending custom forwarding headers. Exploitation is contingent on application configurations that define reverse proxy trust subnets using IPv4-mapped IPv6 notation with short IPv4 prefix lengths. Environments configuring trusted proxies via canonical IPv4 CIDR blocks, hostnames, or default loopback addresses are not vulnerable to this behavior.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-90711"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533602",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533602"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-90711",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-90711"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90711",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90711"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
          "url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"
        }
      ],
      "release_date": "2026-09-15T06:19:46.332000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:08:53+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88198"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw through configuration:\n\n1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation.\n2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`).\n3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications.\n\nWarning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet"
    },
    {
      "cve": "CVE-2026-93748",
      "cwe": {
        "id": "CWE-524",
        "name": "Use of Cache Containing Sensitive Information"
      },
      "discovery_date": "2026-09-22T17:08:12.910081+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2538111"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in http-cache-semantics. This vulnerability allows unauthenticated attackers to retrieve cached responses, including sensitive session credentials like Set-Cookie values, belonging to other users. This occurs because the component fails to properly validate security-zeroed cache entries when processing client `max-stale` directives. By requesting the same URL with a large `max-stale` value, an attacker can obtain another user\u0027s session credentials from shared-cache entries that were intended to be secure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having Important severity for Red Hat products because remote, unauthenticated attackers can bypass shared-cache security controls over the network and expose sensitive session credentials belonging to other users. Red Hat products vendoring this library in client-only command-line tools or local development utilities are at reduced risk, as triggering the defect depends on an intermediary or shared cache mechanism processing client cache-control directives. Environments hosting multi-tenant web applications or reverse proxies that evaluate HTTP cache headers via this component face direct exposure to cross-session credential disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93748"
        },
        {
          "category": "external",
          "summary": "RHBZ#2538111",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538111"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93748",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93748"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93748",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93748"
        },
        {
          "category": "external",
          "summary": "https://github.com/kornelski/http-cache-semantics",
          "url": "https://github.com/kornelski/http-cache-semantics"
        },
        {
          "category": "external",
          "summary": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441",
          "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441"
        },
        {
          "category": "external",
          "summary": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623",
          "url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623"
        },
        {
          "category": "external",
          "summary": "https://github.com/kornelski/http-cache-semantics/issues/56",
          "url": "https://github.com/kornelski/http-cache-semantics/issues/56"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale",
          "url": "https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale"
        }
      ],
      "release_date": "2026-09-18T17:51:34.262000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:08:53+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88198"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive"
    },
    {
      "cve": "CVE-2026-93749",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-09-22T18:17:34.349880+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2538368"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service\u0027s event loop to block, making it unable to process further requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because an unauthenticated remote attacker can supply crafted data that synchronously blocks the single-threaded event loop, resulting in a sustained denial of service for affected services. In standard Red Hat application environments, source map parsing utilities are predominantly utilized in build systems or developer tooling rather than production-facing services, which limits general exposure. However, server-side applications accepting and processing untrusted source maps from external clients are directly susceptible to availability disruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93749"
        },
        {
          "category": "external",
          "summary": "RHBZ#2538368",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538368"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93749",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93749"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93749",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93749"
        },
        {
          "category": "external",
          "summary": "https://github.com/7rulnik/source-map-js",
          "url": "https://github.com/7rulnik/source-map-js"
        },
        {
          "category": "external",
          "summary": "https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118",
          "url": "https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118"
        },
        {
          "category": "external",
          "summary": "https://github.com/7rulnik/source-map-js/issues/76",
          "url": "https://github.com/7rulnik/source-map-js/issues/76"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service",
          "url": "https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"
        }
      ],
      "release_date": "2026-09-18T17:51:34.972000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:08:53+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88198"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps"
    },
    {
      "cve": "CVE-2026-101916",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-09-28T20:33:03.139268+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542678"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in grpc-js. In configurations where client certificates are optional, the authentication context lookup fails to distinguish between authorized and unauthorized peer certificates. A remote attacker can exploit this vulnerability by presenting an untrusted certificate, allowing them to bypass authentication mechanisms and access protected services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grpc-js: grpc-js: Authentication bypass via improper peer certificate validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Important because an unauthenticated remote client could bypass access control mechanisms when exposed gRPC services evaluate optional peer certificates. The issue manifests when services permit client certificates optionally and downstream authorization logic or role-based access control relies on the resulting peer authentication context. In environments where client certificates are strictly mandated or completely disabled at the transport layer, the condition cannot be triggered. Although successful exploitation requires specific configuration prerequisites, it allows complete circumvention of identity verification across exposed network services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-101916"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542678",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542678"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-101916",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-101916"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-101916",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101916"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee",
          "url": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c",
          "url": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5",
          "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j",
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j"
        }
      ],
      "release_date": "2026-09-28T20:01:53.640000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:08:53+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88198"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grpc-js: grpc-js: Authentication bypass via improper peer certificate validation"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.