Red Hat Security Advisory

RHSA-2026:44696

satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview

Released 2026-07-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Satellite 6.17 registry.redhat.io/satellite/iop-advisor-engine-rhel9

Fixes 9 records

TI-2026-35991 CVE-2026-48710 · GHSA-86qp-5c8j-p5mr

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

CRITICAL 86KEV

Starlette is a lightweight ASGI framework/toolkit.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.70288 Published 2026-05-26 Partial fix · 1.0.1 CWE-444

TI-2025-38917 CVE-2025-62727 · GHSA-7f5h-v6xp-fcq8

Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

HIGH 72

Starlette is a lightweight ASGI framework/toolkit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.008 Published 2025-10-28 Partial fix · 0.49.1 CWE-407

TI-2026-17326 CVE-2026-21441 · GHSA-38jv-5279-wg99

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

MEDIUM 50

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.02922 Published 2026-01-07 Partial fix · 2.6.3 CWE-409

TI-2025-40854 CVE-2025-66418 · GHSA-gm62-xv2j-4w53

urllib3 allows an unbounded number of links in the decompression chain

MEDIUM 46

urllib3 is a user-friendly HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00731 Published 2025-12-05 Partial fix · 2.6.0 CWE-770

TI-2026-19738 CVE-2026-24486 · GHSA-wp53-j4wj-2cfg

Python-Multipart has Arbitrary File Write via Non-Default Configuration

MEDIUM 42

Python-Multipart is a streaming multipart parser for Python.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.02206 Published 2026-01-27 Partial fix · 0.0.22 CWE-22

TI-2026-30841 CVE-2026-42561 · GHSA-pp6c-gr5w-3c5g

Python-Multipart: Denial of Service via unbounded multipart part headers

MEDIUM 40

Python-Multipart is a streaming multipart parser for Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0074 Published 2026-05-13 Partial fix · 0.0.27 CWE-770

TI-2025-40898 CVE-2025-66471 · GHSA-2xpw-w6gg-jr37

urllib3 Streaming API improperly handles highly compressed data

MEDIUM 40

urllib3 is a user-friendly HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00731 Published 2025-12-05 Partial fix · 2.6.0 CWE-409

TI-2026-39183 CVE-2026-54283 · GHSA-82w8-qh3p-5jfq

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

LOW 39

Starlette is a lightweight ASGI framework/toolkit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00481 Published 2026-06-22 Partial fix · 1.3.1 CWE-770

TI-2026-32372 CVE-2026-44431 · GHSA-qccp-gfcp-xxvc

urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

LOW 36

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00331 Published 2026-05-13 Partial fix · 2.7.0 CWE-200