Red Hat Security AdvisoryRHSA-2026:2844
Red Hat OpenShift Dev Spaces 3.26.1 Release.
Released 2026-02-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-sshd-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +8
Fixes 6 records
Priority CRITICAL 85
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.74793 · Published 2026-01-27 · Partial fix · 3.6.1, 3.5.5 +3 CWE-787
Priority HIGH 72
Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.00533 · Published 2025-10-31 · Partial fix · 1.2.0, 2.13.4 CWE-400
Priority MEDIUM 45
A flaw was found in libsoup.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0106 · Published 2026-02-02 · Partial fix · 3.6.5-3.el10_1.9, 3.6.5-3.el10_1.10 +20 CWE-121
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02292 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
Priority MEDIUM 40
A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0061 · Published 2026-01-08 · Partial fix · 3.6.5-3.el10_1.9, 3.6.5-3.el10_0.14 +19 CWE-121
Priority MEDIUM 40
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
CVSS 3.1HIGH 8.6· Local · No auth · User interaction · EPSS 0.00531 · Published 2026-02-05 · Partial fix · 1.24.13, 1.25.7 CWE-94
THREATIST.IORead the docs