Red Hat Security Advisory

RHSA-2026:71906

Red Hat Hardened Images RPMs Security Update

Released 2026-09-25 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana13.2-13.2.1-0.7.hum1@aarch64, grafana13.2-13.2.1-0.7.hum1@src, grafana13.2-13.2.1-0.7.hum1@x86_64

Fixes 4 records

TI-2026-62978 CVE-2026-93450 · GHSA-j354-7hcm-wg69

go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

HIGH 77

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01318 Published 2026-09-17 Partial fix · 0.27.1 CWE-674

TI-2026-53084 CVE-2026-75838 · GHSA-748c-f84h-hp2v

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

MEDIUM 56

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00394 Published 2026-08-18 Partial fix · 3.4.13 CWE-79

TI-2026-59166 CVE-2026-86472 · GHSA-hrr3-gc8f-f4qj

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

LOW 22

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00253 Published 2026-09-15 Partial fix · 2.4.7, 3.1.8 +1 CWE-178

TI-2026-63240 CVE-2026-93981 · GHSA-hxh3-vqpv-xpqv

hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

LOW 11

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provid…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00227 Published 2026-09-19 Partial fix · 4.13.7 CWE-79