Read the docs
Red Hat Security Advisory

RHSA-2026:84422

Red Hat Hardened Images RPMs Security Update

Released 2026-10-17 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 3 records

TI-2026-71722 CVE-2026-109955 · GHSA-3g9q-qwv8-cxpf

Middleware bypass in Hono serveStatic via double path decoding

Priority LOW 36

Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00315 Published 2026-10-13 Partial fix · 4.13.11 CWE-174
TI-2026-71901 CVE-2026-33374 · GHSA-5mj5-pfmr-wxjp

Unbounded memory allocation in Grafana Prometheus rule conversion API

Priority LOW 29

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00368 Published 2026-10-13 Partial fix · 12.4.13, 13.0.11 +2 CWE-400
TI-2026-71895 CVE-2026-15577 · GHSA-pm7c-5ghp-r9fq

Git Sync connections can be modified with read-only access in Grafana

Priority LOW 28

A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00269 Published 2026-10-13 Partial fix · 12.4.13, 13.0.11 +2 CWE-863