RHSA-2026:90990

Vulnerability from csaf_redhat - Published: 2026-10-27 16:15 - Updated: 2026-11-01 05:18
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: grafana13.2: * grafana13.2-13.2.4-0.4.hum1 (aarch64, s390x, x86_64) * grafana13.2-13.2.4-0.4.hum1.src (src) Security Fix(es): grafana13.2: * CVE-2026-111181 * CVE-2026-110306 * CVE-2026-110180 * CVE-2026-110095 * CVE-2026-110725
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-79656

A flaw was found in Grafana. When a user signs in using generic OAuth, Google, or GitLab single sign-on connectors, Grafana may write the user's OAuth or OpenID Connect (OIDC) tokens to its server logs in plaintext. This occurs if the identity provider returns an opaque token or if token parsing fails. A local attacker with read access to the Grafana server logs could recover these live credentials, which are scoped to the Grafana OAuth client. This vulnerability is not remotely exploitable and does not directly lead to account takeover.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-256 - Plaintext Storage of a Password
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-110095

A flaw was found in fast-uri. The library improperly applies dot-segment removal to relative Uniform Resource Identifier (URI) paths during normalization, causing leading parent-directory segments to be discarded. A remote attacker could supply a crafted relative path to an application that relies on fast-uri for resolution, caching, or authorization. This can cause the reference to escape its intended directory, potentially allowing unauthorized access to restricted resources.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Affected products
Fixed 4 products, the same list as for CVE-2026-79656
Threats
Impact Low
CVE-2026-110180

A flaw was found in fast-uri. When processing web addresses, the host canonicalization mechanism can silently strip control characters or drop user information without verifying that the full host input was consumed. A remote attacker can exploit this parsing discrepancy by supplying a specially crafted address to bypass host-based security policies, such as domain blocklists, redirect validations, or proxy routing rules. As a result, applications may inadvertently direct network requests to unintended destinations.

4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Affected products
Fixed 4 products, the same list as for CVE-2026-79656
Threats
Impact Moderate
CVE-2026-110306

A flaw was found in fast-uri. The library incorrectly decodes percent-encoded characters in protocol schemes prior to validation, causing invalid or prohibited schemes to be accepted as valid. A remote attacker can exploit this vulnerability by submitting a specially crafted Uniform Resource Identifier (URI) to bypass application allowlists, potentially leading to Cross-Site Scripting (XSS) if the normalized output is rendered in a web browser.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Affected products
Fixed 4 products, the same list as for CVE-2026-79656
Threats
Impact Moderate
CVE-2026-110725

A flaw was found in fast-uri. A remote attacker could exploit this vulnerability to trigger cross-site scripting (XSS) by providing crafted input to applications that serialize or normalize relative Uniform Resource Identifiers (URIs) using the suffix reference option. Because the library fails to properly escape colons in the first path segment of relative paths, the generated string can be misinterpreted by downstream components as an absolute URI with an executable scheme.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation
Affected products
Fixed 4 products, the same list as for CVE-2026-79656
Threats
Impact Low
CVE-2026-111181

A flaw was found in body-parser. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by sending a specially crafted HTTP request with compressed content containing unexpected trailing data. Because the application fails to handle decompression stream errors after processing the initial compressed content, the trailing data triggers an uncaught exception that terminates the server process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248 - Uncaught Exception
Affected products
Fixed 4 products, the same list as for CVE-2026-79656
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:90990 self
https://access.redhat.com/security/cve/CVE-2026-110095 external
https://access.redhat.com/security/cve/CVE-2026-110180 external
https://access.redhat.com/security/cve/CVE-2026-110306 external
https://access.redhat.com/security/cve/CVE-2026-110725 external
https://access.redhat.com/security/cve/CVE-2026-111181 external
https://access.redhat.com/security/updates/classi… external
https://images.redhat.com/ external
https://access.redhat.com/security/cve/CVE-2026-16491 external
https://access.redhat.com/security/cve/CVE-2026-79656 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-79656 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528700 external
https://www.cve.org/CVERecord?id=CVE-2026-79656 external
https://nvd.nist.gov/vuln/detail/CVE-2026-79656 external
https://access.redhat.com/security/cve/CVE-2026-110095 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556002 external
https://www.cve.org/CVERecord?id=CVE-2026-110095 external
https://nvd.nist.gov/vuln/detail/CVE-2026-110095 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-110180 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556008 external
https://www.cve.org/CVERecord?id=CVE-2026-110180 external
https://nvd.nist.gov/vuln/detail/CVE-2026-110180 external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-110306 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556005 external
https://www.cve.org/CVERecord?id=CVE-2026-110306 external
https://nvd.nist.gov/vuln/detail/CVE-2026-110306 external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-110725 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556007 external
https://www.cve.org/CVERecord?id=CVE-2026-110725 external
https://nvd.nist.gov/vuln/detail/CVE-2026-110725 external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-111181 self
https://bugzilla.redhat.com/show_bug.cgi?id=2559049 external
https://www.cve.org/CVERecord?id=CVE-2026-111181 external
https://nvd.nist.gov/vuln/detail/CVE-2026-111181 external
https://github.com/expressjs/body-parser/security… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.2:\n  * grafana13.2-13.2.4-0.4.hum1 (aarch64, s390x, x86_64)\n  * grafana13.2-13.2.4-0.4.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana13.2:\n  * CVE-2026-111181\n  * CVE-2026-110306\n  * CVE-2026-110180\n  * CVE-2026-110095\n  * CVE-2026-110725",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:90990",
        "url": "https://access.redhat.com/errata/RHSA-2026:90990"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110095",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110095"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110180",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110180"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110306",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110306"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110725",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110725"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-111181",
        "url": "https://access.redhat.com/security/cve/CVE-2026-111181"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-16491",
        "url": "https://access.redhat.com/security/cve/CVE-2026-16491"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-79656",
        "url": "https://access.redhat.com/security/cve/CVE-2026-79656"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_90990.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-11-01T05:18:09+00:00",
      "generator": {
        "date": "2026-11-01T05:18:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:90990",
      "initial_release_date": "2026-10-27T16:15:33+00:00",
      "revision_history": [
        {
          "date": "2026-10-27T16:15:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-29T14:02:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-01T05:18:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.4-0.4.hum1@aarch64",
                "product": {
                  "name": "grafana13.2-0:13.2.4-0.4.hum1@aarch64",
                  "product_id": "grafana13.2-0:13.2.4-0.4.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.4-0.4.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.4-0.4.hum1@s390x",
                "product": {
                  "name": "grafana13.2-0:13.2.4-0.4.hum1@s390x",
                  "product_id": "grafana13.2-0:13.2.4-0.4.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.4-0.4.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.4-0.4.hum1@src",
                "product": {
                  "name": "grafana13.2-0:13.2.4-0.4.hum1@src",
                  "product_id": "grafana13.2-0:13.2.4-0.4.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.4-0.4.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.4-0.4.hum1@x86_64",
                "product": {
                  "name": "grafana13.2-0:13.2.4-0.4.hum1@x86_64",
                  "product_id": "grafana13.2-0:13.2.4-0.4.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.4-0.4.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.4-0.4.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64"
        },
        "product_reference": "grafana13.2-0:13.2.4-0.4.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.4-0.4.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x"
        },
        "product_reference": "grafana13.2-0:13.2.4-0.4.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.4-0.4.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src"
        },
        "product_reference": "grafana13.2-0:13.2.4-0.4.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.4-0.4.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
        },
        "product_reference": "grafana13.2-0:13.2.4-0.4.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-79656",
      "cwe": {
        "id": "CWE-256",
        "name": "Plaintext Storage of a Password"
      },
      "discovery_date": "2026-09-04T16:19:20.134000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528700"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. When a user signs in using generic OAuth, Google, or GitLab single sign-on connectors, Grafana may write the user\u0027s OAuth or OpenID Connect (OIDC) tokens to its server logs in plaintext. This occurs if the identity provider returns an opaque token or if token parsing fails. A local attacker with read access to the Grafana server logs could recover these live credentials, which are scoped to the Grafana OAuth client. This vulnerability is not remotely exploitable and does not directly lead to account takeover.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: OAuth and OIDC tokens written unredacted to Grafana server logs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated Moderate because it requires local access to Grafana server logs to exploit. While sensitive OAuth and OIDC tokens may be written to logs under specific SSO configurations, the vulnerability is not remotely exploitable, and the impact is limited by the scopes granted to the Grafana OAuth client, preventing direct account takeover.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-79656"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528700",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528700"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-79656",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-79656"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-79656",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79656"
        }
      ],
      "release_date": "2026-10-29T13:02:28.194000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T16:15:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90990"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict read access to Grafana server logs and any downstream log pipelines. Additionally, minimize the scopes granted to the Grafana OAuth client to limit the potential impact of leaked tokens. If your identity provider issues long-lived or non-expiring tokens, consider rotating the Grafana OAuth client secret and revoking issued tokens at the provider.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: OAuth and OIDC tokens written unredacted to Grafana server logs"
    },
    {
      "cve": "CVE-2026-110095",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory"
      },
      "discovery_date": "2026-10-20T07:00:55.676503+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556002"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. The library improperly applies dot-segment removal to relative Uniform Resource Identifier (URI) paths during normalization, causing leading parent-directory segments to be discarded. A remote attacker could supply a crafted relative path to an application that relies on fast-uri for resolution, caching, or authorization. This can cause the reference to escape its intended directory, potentially allowing unauthorized access to restricted resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Path traversal via improper relative URI normalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Low impact because exploitation requires an application to specifically pass untrusted relative paths to URI normalization or serialization routines prior to base resolution or access control checks. Within Red Hat products, fast-uri is primarily present as an indirect dependency in web consoles, dashboard interfaces, and frontend tooling. Typical product deployments do not expose authorization or routing workflows that rely on standalone relative URI normalization of untrusted input, substantially limiting the attack surface.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110095"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556002",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556002"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110095",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110095"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110095",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110095"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"
        }
      ],
      "release_date": "2026-10-20T06:56:56.456000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T16:15:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90990"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization"
    },
    {
      "cve": "CVE-2026-110180",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-10-20T07:21:50.840605+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556008"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. When processing web addresses, the host canonicalization mechanism can silently strip control characters or drop user information without verifying that the full host input was consumed. A remote attacker can exploit this parsing discrepancy by supplying a specially crafted address to bypass host-based security policies, such as domain blocklists, redirect validations, or proxy routing rules. As a result, applications may inadvertently direct network requests to unintended destinations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because exploitation requires a specific application architecture where host-based access controls or redirection boundaries rely directly on fast-uri parsing of untrusted network input. Because successful manipulation only allows bypassing host filters or redirecting traffic rather than granting arbitrary code execution, the overall blast radius remains constrained. In Red Hat environments, the affected Node.js package is primarily distributed as an embedded dependency within web applications and plugins, meaning the risk is contingent upon whether the consuming service exposes URL canonicalization to external users.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110180"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556008",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556008"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110180",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110180"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110180",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110180"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"
        }
      ],
      "release_date": "2026-10-20T07:00:42.153000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T16:15:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90990"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization"
    },
    {
      "cve": "CVE-2026-110306",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-10-20T07:21:28.248626+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556005"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. The library incorrectly decodes percent-encoded characters in protocol schemes prior to validation, causing invalid or prohibited schemes to be accepted as valid. A remote attacker can exploit this vulnerability by submitting a specially crafted Uniform Resource Identifier (URI) to bypass application allowlists, potentially leading to Cross-Site Scripting (XSS) if the normalized output is rendered in a web browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact for Red Hat products because successful exploitation requires user interaction to execute cross-site scripting in a browser and does not permit direct server-side compromise or privilege escalation. The flaw affects application environments that rely on fast-uri to parse and normalize untrusted URIs without performing downstream output sanitization. In many Red Hat web user interfaces and console plugins, overall exposure is further constrained by framework-level sanitization and browser security controls such as Content Security Policy.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110306"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556005",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556005"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110306",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110306"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110306",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110306"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"
        }
      ],
      "release_date": "2026-10-20T07:03:47.312000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T16:15:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90990"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding"
    },
    {
      "cve": "CVE-2026-110725",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2026-10-20T07:21:44.951200+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556007"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. A remote attacker could exploit this vulnerability to trigger cross-site scripting (XSS) by providing crafted input to applications that serialize or normalize relative Uniform Resource Identifiers (URIs) using the suffix reference option. Because the library fails to properly escape colons in the first path segment of relative paths, the generated string can be misinterpreted by downstream components as an absolute URI with an executable scheme.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Low impact because exploitation is constrained to applications invoking specific non-default parsing configurations on untrusted input without scheme authority. Across Red Hat products, this library is primarily embedded as an internal dependency within build pipelines and administrative web consoles, where user-controlled relative URIs are not handled using this specialized setting. Consequently, the likelihood of triggering cross-site scripting or URI misinterpretation in default deployments is minimal.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110725"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556007",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556007"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110725",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110725"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110725",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110725"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"
        }
      ],
      "release_date": "2026-10-20T07:06:29.946000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T16:15:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90990"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths"
    },
    {
      "cve": "CVE-2026-111181",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-10-22T14:41:42.751154+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2559049"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in body-parser. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by sending a specially crafted HTTP request with compressed content containing unexpected trailing data. Because the application fails to handle decompression stream errors after processing the initial compressed content, the trailing data triggers an uncaught exception that terminates the server process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "body-parser: body-parser: Denial of Service via unhandled decompression stream error",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because an unauthenticated remote attacker can crash the entire application process, leading to a complete denial of service. Applications that rely on default body-parser configurations automatically decompress incoming request bodies before route matching and authentication are executed. As a result, any exposed endpoint accepting body data can be exploited without privileges, causing an uncaught stream exception that terminates the Node.js runtime.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111181"
        },
        {
          "category": "external",
          "summary": "RHBZ#2559049",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559049"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111181",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111181"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111181",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111181"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828",
          "url": "https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"
        }
      ],
      "release_date": "2026-10-22T14:29:56.577000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T16:15:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90990"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.