Update registry.redhat.io/openshift4/ose-cli-rhel9 Docker digest to b53c024 [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
registry.redhat.io/openshift4/ose-cli-rhel9	stage	digest	ac644e3 → b53c024

---

fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority

CVE-2026-18446

More information

Details

A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers (URIs) when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion. A remote attacker could exploit this to bypass security policies, such as allowlists or Server-Side Request Forgery (SSRF) filters, potentially redirecting applications to unintended hosts.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-18446
• https://bugzilla.redhat.com/show_bug.cgi?id=2509801
• https://www.cve.org/CVERecord?id=CVE-2026-18446
• https://nvd.nist.gov/vuln/detail/CVE-2026-18446
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7

---

baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling

CVE-2026-45819

More information

Details

A flaw was found in baseline-browser-mapping. This vulnerability allows an attacker to cause a denial of service by providing invalid or conflicting input parameters. The affected component improperly terminates the process instead of handling the input error gracefully, leading to immediate service disruption.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-45819
• https://bugzilla.redhat.com/show_bug.cgi?id=2515240
• https://www.cve.org/CVERecord?id=CVE-2026-45819
• https://nvd.nist.gov/vuln/detail/CVE-2026-45819
• https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142
• https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519
• https://www.npmjs.com/package/baseline-browser-mapping

---

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

CVE-2026-45623

More information

Details

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifically the first few bytes of file content. Additionally, this vulnerability may be exploited to cause a Denial of Service (DoS) by targeting large files, making the system unavailable.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-45623
• https://bugzilla.redhat.com/show_bug.cgi?id=2507595
• https://www.cve.org/CVERecord?id=CVE-2026-45623
• https://nvd.nist.gov/vuln/detail/CVE-2026-45623
• https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q

---

linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability

CVE-2026-48801

More information

Details

A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of O(N²) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-48801
• https://bugzilla.redhat.com/show_bug.cgi?id=2500656
• https://www.cve.org/CVERecord?id=CVE-2026-48801
• https://nvd.nist.gov/vuln/detail/CVE-2026-48801
• https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159
• https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4

---

ironic-python-agent: OpenStack Ironic Python Agent: Arbitrary code execution via malicious configuration

CVE-2026-66138

More information

Details

A vulnerability was found in Ironic-Python-Agent's (IPA) time syncing code. The value of the ntp_server configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root. This value can be set in three ways; directly in an operator-created ramdisk, set via kernel command line using Ironic, or passing the parameters via mDNS responder for mDNS enabled installation. For the most common, and highest security risk case, this means a Manager role associated with the project set as node.owner may be able to trigger this vulnerability.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-66138
• https://bugzilla.redhat.com/show_bug.cgi?id=2506676
• https://www.cve.org/CVERecord?id=CVE-2026-66138
• https://nvd.nist.gov/vuln/detail/CVE-2026-66138
• https://bugs.launchpad.net/ironic-python-agent/+bug/2160050
• https://launchpad.net/bugs/2160050
• https://opendev.org/openstack/ossa/commit/b6468150ceb59957bfe541d431e90b9651abed51
• https://review.opendev.org/c/openstack/ironic-python-agent/+/998486
• https://security.openstack.org/ossa/OSSA-2026-027.html

---

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

CVE-2026-69153

More information

Details

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-69153
• https://bugzilla.redhat.com/show_bug.cgi?id=2510719
• https://www.cve.org/CVERecord?id=CVE-2026-69153
• https://nvd.nist.gov/vuln/detail/CVE-2026-69153
• https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
• https://github.com/postcss/postcss/releases/tag/8.5.19
• https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp

---

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

CVE-2026-14257

More information

Details

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-14257
• https://bugzilla.redhat.com/show_bug.cgi?id=2506433
• https://www.cve.org/CVERecord?id=CVE-2026-14257
• https://nvd.nist.gov/vuln/detail/CVE-2026-14257
• https://github.com/juliangruber/brace-expansion
• https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5
• https://www.npmjs.com/package/brace-expansion

---

js-yaml: js-yaml: Denial of Service via crafted YAML documents

CVE-2026-59869

More information

Details

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-59869
• https://bugzilla.redhat.com/show_bug.cgi?id=2498122
• https://www.cve.org/CVERecord?id=CVE-2026-59869
• https://nvd.nist.gov/vuln/detail/CVE-2026-59869
• https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
• https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
• https://github.com/nodeca/js-yaml/releases/tag/3.15.0
• https://github.com/nodeca/js-yaml/releases/tag/4.3.0
• https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m

---

protobufjs: protobufjs: Denial of Service via crafted .proto schema

CVE-2026-59877

More information

Details

A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library's parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-59877
• https://bugzilla.redhat.com/show_bug.cgi?id=2498127
• https://www.cve.org/CVERecord?id=CVE-2026-59877
• https://nvd.nist.gov/vuln/detail/CVE-2026-59877
• https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217
• https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f
• https://github.com/protobufjs/protobuf.js/pull/2352
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6
• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww

---

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

CVE-2026-69152

More information

Details

A flaw was found in the brace-expansion library. The expand() function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-69152
• https://bugzilla.redhat.com/show_bug.cgi?id=2510722
• https://www.cve.org/CVERecord?id=CVE-2026-69152
• https://nvd.nist.gov/vuln/detail/CVE-2026-69152
• https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
• https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
• https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
• https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895

---

nanoid: nanoid: Predictable ID generation due to integer overflow

CVE-2026-73086

More information

Details

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoid(size) function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-73086
• https://bugzilla.redhat.com/show_bug.cgi?id=2514175
• https://www.cve.org/CVERecord?id=CVE-2026-73086
• https://nvd.nist.gov/vuln/detail/CVE-2026-73086
• https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4
• https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3
• https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac
• https://github.com/ai/nanoid/releases/tag/3.3.12
• https://github.com/ai/nanoid/releases/tag/5.1.11
• https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w

---

hypershift: Konnectivity proxy-server accepts agent connections without validating client certificates

CVE-2026-16242

More information

Details

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.

Severity

Critical

References

• https://access.redhat.com/security/cve/CVE-2026-16242
• https://bugzilla.redhat.com/show_bug.cgi?id=2502690
• https://www.cve.org/CVERecord?id=CVE-2026-16242
• https://nvd.nist.gov/vuln/detail/CVE-2026-16242
• https://github.com/openshift/hypershift/pull/9031

---

qs: qs: Denial of Service via improper validation in stringify function

CVE-2026-82417

More information

Details

A flaw was found in qs. The qs.stringify function, responsible for serializing objects, does not properly validate the isBuffer property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then serialized by qs.stringify, triggers a TypeError. This vulnerability can lead to a Denial of Service (DoS), causing affected applications to return a 500 error or, in certain scenarios, terminate the application process.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-82417
• https://bugzilla.redhat.com/show_bug.cgi?id=2525936
• https://www.cve.org/CVERecord?id=CVE-2026-82417
• https://nvd.nist.gov/vuln/detail/CVE-2026-82417
• https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6
• https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g

---

sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing

CVE-2026-54284

More information

Details

A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit a vulnerability in the TokenList construction and string conversion processes, specifically when handling nested token subtrees. This flaw leads to quadratic CPU consumption, which can result in a Denial of Service (DoS) by exhausting system resources before internal limits are reached.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-54284
• https://bugzilla.redhat.com/show_bug.cgi?id=2517527
• https://www.cve.org/CVERecord?id=CVE-2026-54284
• https://nvd.nist.gov/vuln/detail/CVE-2026-54284
• https://github.com/andialbrecht/sqlparse/commit/939b129e24c0ad5d51368b1aa72fffcaca76f06f
• https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f

---

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

CVE-2026-56852

More information

Details

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56852
• https://bugzilla.redhat.com/show_bug.cgi?id=2504233
• https://www.cve.org/CVERecord?id=CVE-2026-56852
• https://nvd.nist.gov/vuln/detail/CVE-2026-56852
• https://go.dev/cl/794100
• https://go.dev/issue/80142
• https://pkg.go.dev/vuln/GO-2026-5970

---

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

CVE-2026-33818

More information

Details

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-33818
• https://bugzilla.redhat.com/show_bug.cgi?id=2515815
• https://www.cve.org/CVERecord?id=CVE-2026-33818
• https://nvd.nist.gov/vuln/detail/CVE-2026-33818
• https://go.dev/cl/814980
• https://go.dev/issue/80405
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-5972

---

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

CVE-2026-56858

More information

Details

A flaw was found in the html/template component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56858
• https://bugzilla.redhat.com/show_bug.cgi?id=2515838
• https://www.cve.org/CVERecord?id=CVE-2026-56858
• https://nvd.nist.gov/vuln/detail/CVE-2026-56858
• https://go.dev/cl/807100
• https://go.dev/issue/80435
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6091

---

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

CVE-2026-56859

More information

Details

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56859
• https://bugzilla.redhat.com/show_bug.cgi?id=2515840
• https://www.cve.org/CVERecord?id=CVE-2026-56859
• https://nvd.nist.gov/vuln/detail/CVE-2026-56859
• https://go.dev/cl/803320
• https://go.dev/issue/80481
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6088

---

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

CVE-2026-56860

More information

Details

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56860
• https://bugzilla.redhat.com/show_bug.cgi?id=2515820
• https://www.cve.org/CVERecord?id=CVE-2026-56860
• https://nvd.nist.gov/vuln/detail/CVE-2026-56860
• https://go.dev/cl/803681
• https://go.dev/issue/80494
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6218

---

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

CVE-2026-56862

More information

Details

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56862
• https://bugzilla.redhat.com/show_bug.cgi?id=2515839
• https://www.cve.org/CVERecord?id=CVE-2026-56862
• https://nvd.nist.gov/vuln/detail/CVE-2026-56862
• https://go.dev/cl/804261
• https://go.dev/issue/80528
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6090

---

github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling

CVE-2026-14362

More information

Details

A flaw was found in HashiCorp memberlist. An attacker with network access to the gossip port could exploit a vulnerability in the push/pull state handling. This could lead to memory exhaustion on a receiving node, causing the process to terminate. This flaw results in a Denial of Service (DoS).

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-14362
• https://bugzilla.redhat.com/show_bug.cgi?id=2498174
• https://www.cve.org/CVERecord?id=CVE-2026-14362
• https://nvd.nist.gov/vuln/detail/CVE-2026-14362
• https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556

---

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

CVE-2026-49978

More information

Details

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a <template>.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.

Severity

Critical

References

• https://access.redhat.com/security/cve/CVE-2026-49978
• https://bugzilla.redhat.com/show_bug.cgi?id=2500695
• https://www.cve.org/CVERecord?id=CVE-2026-49978
• https://nvd.nist.gov/vuln/detail/CVE-2026-49978
• https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff
• https://github.com/cure53/DOMPurify/releases/tag/3.4.7
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq

---

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

CVE-2026-54272

More information

Details

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery (SSRF) due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassification to bypass network restrictions and potentially access or manipulate internal resources. This vulnerability can be exploited on any dual-stack host for IPv4-mapped addresses, and for NAT64, it requires a NAT64/DNS64 gateway in the deployment network.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-54272
• https://bugzilla.redhat.com/show_bug.cgi?id=2507593
• https://www.cve.org/CVERecord?id=CVE-2026-54272
• https://nvd.nist.gov/vuln/detail/CVE-2026-54272
• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg

---

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

CVE-2026-69192

More information

Details

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-69192
• https://bugzilla.redhat.com/show_bug.cgi?id=2510801
• https://www.cve.org/CVERecord?id=CVE-2026-69192
• https://nvd.nist.gov/vuln/detail/CVE-2026-69192
• https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e
• https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1
• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr

---

tar: node-tar: Denial of Service via crafted long-path tar archive

CVE-2026-73566

More information

Details

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the filesFilter function can lead to a stack overflow. This issue results in a denial of service (DoS) by terminating Node.js applications that consume these archives.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-73566
• https://bugzilla.redhat.com/show_bug.cgi?id=2515509
• https://www.cve.org/CVERecord?id=CVE-2026-73566
• https://nvd.nist.gov/vuln/detail/CVE-2026-73566
• https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a
• https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m

---

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

CVE-2026-49978

More information

Details

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a <template>.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-49978
• https://bugzilla.redhat.com/show_bug.cgi?id=2500695
• https://www.cve.org/CVERecord?id=CVE-2026-49978
• https://nvd.nist.gov/vuln/detail/CVE-2026-49978
• https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff
• https://github.com/cure53/DOMPurify/releases/tag/3.4.7
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq

---

tar: node-tar: Denial of Service via crafted gzip bomb

CVE-2026-59873

More information

Details

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-59873
• https://bugzilla.redhat.com/show_bug.cgi?id=2498120
• https://www.cve.org/CVERecord?id=CVE-2026-59873
• https://nvd.nist.gov/vuln/detail/CVE-2026-59873
• https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3
• https://github.com/isaacs/node-tar/releases/tag/v7.5.19
• https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw

---

oc-mirror__release-4.21: Embedded local cache registry listens on all interfaces without authentication, with delete enabled

CVE-2026-96577

More information

Details

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-96577
• https://bugzilla.redhat.com/show_bug.cgi?id=2523077
• https://www.cve.org/CVERecord?id=CVE-2026-96577
• https://nvd.nist.gov/vuln/detail/CVE-2026-96577

---

nanoid: nanoid: Denial of Service via infinite loop in random ID generation

CVE-2026-67213

More information

Details

A flaw was found in nanoid (Nano ID), a small, secure, and URL-friendly unique string ID generator. An attacker could exploit this vulnerability by providing a zero-size input to the customAlphabet or customRandom functions. This would cause an infinite loop, leading to a denial of service (DoS) condition by hanging the application's calling thread.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-67213
• https://bugzilla.redhat.com/show_bug.cgi?id=2508406
• https://www.cve.org/CVERecord?id=CVE-2026-67213
• https://nvd.nist.gov/vuln/detail/CVE-2026-67213
• https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7
• https://github.com/ai/nanoid/releases/tag/5.1.6
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom

---

openshift/oc-mirror: Release signature verification: OpenPGP SignatureError checked before signed body is consumed

CVE-2026-75939

More information

Details

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the oc-mirror tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-75939
• https://bugzilla.redhat.com/show_bug.cgi?id=2517976
• https://www.cve.org/CVERecord?id=CVE-2026-75939
• https://nvd.nist.gov/vuln/detail/CVE-2026-75939

---

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

CVE-2026-56853

More information

Details

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-56853
• https://bugzilla.redhat.com/show_bug.cgi?id=2515827
• https://www.cve.org/CVERecord?id=CVE-2026-56853
• https://nvd.nist.gov/vuln/detail/CVE-2026-56853
• https://go.dev/cl/795540
• https://go.dev/issue/80205
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6089

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.