Red Hat Security Advisory

RHSA-2026:70829

RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release

Released 2026-09-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6

Fixes 10 records

TI-2026-51730 CVE-2026-73646 · GHSA-r28c-9q8g-f849

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

HIGH 72

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0053 Published 2026-08-17 Partial fix · 8.5.18 CWE-22

TI-2026-51295 CVE-2026-73088 · GHSA-73wf-gq98-2v4g

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

HIGH 72

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00658 Published 2026-08-11 Partial fix · 4.28.7 CWE-1321

TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m

js-yaml: YAML merge-key chains can force quadratic CPU consumption

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00585 Published 2026-07-08 Partial fix · 3.15.0, 4.3.0 CWE-407

TI-2026-36049 CVE-2026-48779 · GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

HIGH 72

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01426 Published 2026-06-16 Partial fix · 5.2.5, 6.2.4 +2 CWE-400

TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

HIGH 66

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00745 Published 2026-05-15 Partial fix · 8.20.1 CWE-908

TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835

OpenTelemetry-Go's baggage parsing no longer caps raw header length

MEDIUM 63

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00336 Published 2026-06-04 Partial fix · 1.42.0, 1.44.0 CWE-789

TI-2026-51612 CVE-2026-73500 · GHSA-6vch-q96h-7gc3

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

MEDIUM 44

etcd is a distributed key-value store for the data of a distributed system.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00396 Published 2026-08-12 Partial fix · 3.5.33, 3.6.14 +1 CWE-770

TI-2026-51296 CVE-2026-73089 · GHSA-c83g-rgw3-j3cx

Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

MEDIUM 40

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00655 Published 2026-08-11 Partial fix · 4.28.7 CWE-770

TI-2026-40994 CVE-2026-56854 · GHSA-gjhq-gjfw-99mq

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

LOW 39

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00437 Published 2026-08-28 Partial fix · 0.55.0 CWE-863

TI-2026-51293 CVE-2026-73086 · GHSA-xwg4-73v4-xw9w

nanoid: Integer Overflow or Wraparound

LOW 34

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00296 Published 2026-08-11 Partial fix · 3.3.12, 5.1.11 CWE-190