Red Hat Security Advisory

RHSA-2026:36820

Red Hat OpenShift Dev Spaces 3.29.0 Release.

Released 2026-07-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6

Fixes 31 records

TI-2026-30861 CVE-2026-42581 · GHSA-xxqh-mfjm-7mv9

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

HIGH 81

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0063 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444

TI-2026-30864 CVE-2026-42584 · GHSA-57rv-r2g8-2cj3

Netty: HttpClientCodec response desynchronization

HIGH 78

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00838 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444

TI-2026-30859 CVE-2026-42579 · GHSA-cm33-6792-r9fm

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

HIGH 78

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01006 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-20

TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv

Server-side request forgery in axios

HIGH 76

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.1228 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-918

TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

HIGH 73

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.01057 Published 2026-06-11 Partial fix · 1.16.0 CWE-1321

TI-2026-37281 CVE-2026-50559 · GHSA-qcxp-gm7m-4j5v

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

HIGH 72

Quarkus is a Java framework for building cloud-native applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01023 Published 2026-06-19 Partial fix · 3.36.3, 3.33.2.1 +3 CWE-287

TI-2026-36049 CVE-2026-48779 · GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

HIGH 72

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01426 Published 2026-06-16 Partial fix · 5.2.5, 6.2.4 +2 CWE-400

TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05405 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-1333

TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf

Axios: Allocation of Resources Without Limits or Throttling in axios

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00669 Published 2026-06-11 Partial fix · 1.16.0 CWE-770

TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00552 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-200

TI-2026-30867 CVE-2026-42587 · GHSA-f6hv-jmp6-3vwv

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

HIGH 72

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0099 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400

TI-2026-30863 CVE-2026-42583 · GHSA-mj4r-2hfc-f8p6

Netty: Lz4FrameDecoder resource exhaustion

HIGH 72

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400

TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00854 Published 2026-06-11 Partial fix · 1.15.2, 0.31.1 CWE-1321

TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00689 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-201

TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

HIGH 66

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00745 Published 2026-05-15 Partial fix · 8.20.1 CWE-908

TI-2026-30642 CVE-2026-42338 · GHSA-v2v4-37r5-5v8g

ip-address: XSS in Address6 HTML-emitting methods

MEDIUM 57

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00471 Published 2026-05-12 Partial fix · 10.1.1 CWE-79

TI-2026-34255 CVE-2026-46595 · GHSA-x527-x647-q7gg

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

MEDIUM 50

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00556 Published 2026-05-22 Partial fix · 0.52.0 CWE-863

TI-2026-30858 CVE-2026-42578 · GHSA-45q3-82m4-75jr

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

MEDIUM 48

Netty is an asynchronous, event-driven network application framework.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.01065 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-113

TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

MEDIUM 47

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01834 Published 2026-05-22 Partial fix · 1.25.13, 1.26.6 +2 CWE-1289

TI-2026-35500 CVE-2026-48059 · GHSA-h2qv-fj59-j46j

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

MEDIUM 45

Netty is a network application framework for development of protocol servers and clients.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0063 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-401

TI-2026-10972 CVE-2026-12856 · GHSA-7vqr-7r5j-c84j

Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

MEDIUM 41

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00549 Published 2026-06-29 Fixed in 1782989367 CWE-88

TI-2026-35485 CVE-2026-48043 · GHSA-c2gf-v879-257j

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00753 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-400

TI-2026-32768 CVE-2026-44893 · GHSA-cc37-9q2j-3hfv

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00617 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-703

TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248

TI-2026-10459 CVE-2026-12151 · GHSA-vxpw-j846-p89q

undici WebSocket client vulnerable to denial of service via fragment count bypass

MEDIUM 40

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00789 Published 2026-06-17 Partial fix · 6.26.0, 7.28.0 +2 CWE-400

TI-2026-05900 CVE-2026-6734 · GHSA-hm92-r4w5-c3mj

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

MEDIUM 40

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00345 Published 2026-06-17 Partial fix · 7.26.0, 8.2.0 +1 CWE-346

TI-2026-32226 CVE-2026-44249 · GHSA-3qp7-7mw8-wx86

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00987 Published 2026-06-11 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-284

TI-2026-28711 CVE-2026-39829 · GHSA-w879-237q-wc7r

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

LOW 39

The RSA and DSA public key parsers did not enforce size limits on key parameters.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00467 Published 2026-05-22 Partial fix · 0.52.0 CWE-347

TI-2026-32659 CVE-2026-44774 · GHSA-96qj-4jj5-wcjc

Improper access control in traefik

LOW 35

Traefik is an HTTP reverse proxy and load balancer.

CVSS 4.0MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00468 Published 2026-05-15 Fixed in 2.11.46, 3.6.17 +1 CWE-284

TI-2026-08499 CVE-2026-9697 · GHSA-vmh5-mc38-953g

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

LOW 35

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://).

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00459 Published 2026-06-17 Partial fix · 7.28.0, 8.5.0 CWE-295

TI-2026-33092 CVE-2026-45292 · GHSA-rcgg-9c38-7xpx

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

LOW 26

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01097 Published 2026-05-28 Partial fix · 1.62.0 CWE-770