Read the docs
TI-2026-30483 Aliases CVE-2026-42154GHSA-8rm2-7qqf-34qm

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 45 fixed, 11 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00813 57th percentileScored 2026-11-07
Fix Partial prometheus (prometheus): 3.5.3, 3.11.3github.com/prometheus/prometheus (Go): 0.311.3, 0.305.2Red Hat: 54 advisoriesRed Hat: 45 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
prometheusprometheusbefore 3.5.3; 3.6.0 to before 3.11.33.5.3, 3.11.3Patch availableCNA
—github.com/prometheus/prometheus (Go)0.306.0 to before 0.311.30.311.3Patch availableGHSA-8rm2-7qqf-34qm
—github.com/prometheus/prometheus (Go)before 0.305.20.305.2Patch availableGHSA-8rm2-7qqf-34qm
—github.com/prometheus/prometheus (Go)1.0.0-rc.0 – 2.5.0—No fix listedGHSA-8rm2-7qqf-34qm
  • prometheus Vendorprometheus Affected before 3.5.3; 3.6.0 to before 3.11.3 Fixed in 3.5.3, 3.11.3 Patch available CNA
  • github.com/prometheus/prometheus (Go) Vendor— Affected 0.306.0 to before 0.311.3 Fixed in 0.311.3 Patch available GHSA-8rm2-7qqf-34qm
  • github.com/prometheus/prometheus (Go) Vendor— Affected before 0.305.2 Fixed in 0.305.2 Patch available GHSA-8rm2-7qqf-34qm
  • github.com/prometheus/prometheus (Go) Vendor— Affected 1.0.0-rc.0 – 2.5.0 Fixed in — No fix listed GHSA-8rm2-7qqf-34qm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*before 3.5.3; 3.6.0 to before 3.11.3Vulnerableprometheus
  • cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:* Versions before 3.5.3; 3.6.0 to before 3.11.3 Vulnerable ·prometheus

Remediation

  • Fix · CNA prometheus (prometheus) Fixed in 3.5.3, 3.11.3
  • Fix · GHSA-8rm2-7qqf-34qm github.com/prometheus/prometheus (Go) Fixed in 0.311.3 Advisory →
  • Fix · GHSA-8rm2-7qqf-34qm github.com/prometheus/prometheus (Go) Fixed in 0.305.2 Advisory →

Red Hat 54 advisories

  • RHSA-2026:83013 Released 2026-10-14 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.17
    • Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:77639 Released 2026-10-07 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.4.7
    • Logging Subsystem for Red Hat OpenShift 6.4 registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
  • RHSA-2026:74511 Released 2026-10-01 · Red Hat rating Important
    Red Hat Quay 3.17.5
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
Show 51 more Red Hat advisories
  • RHSA-2026:70870 Released 2026-09-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.5.3
    • Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:65840 Released 2026-09-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.71 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:67542 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
  • RHSA-2026:67541 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.7 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +9
  • RHSA-2026:67539 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +7
  • RHSA-2026:67538 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.12 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +8
  • RHSA-2026:59833 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.12.97 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:56912 Released 2026-08-26 · Red Hat rating Critical
    OpenShift Container Platform 4.15.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-console +5
  • RHSA-2026:56789 Released 2026-08-26 · Red Hat rating Critical
    OpenShift Container Platform 4.14.72 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8 +5
  • RHSA-2026:56340 Released 2026-08-18 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.5.2
    • Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:50758 Released 2026-08-12 · Red Hat rating Critical
    OpenShift Container Platform 4.16.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +2
  • RHSA-2026:54288 Released 2026-08-12 · Red Hat rating Important
    OpenShift File Integrity Operator bug fix and enhancement update
    • OpenShift File Integrity Operator - FIO 1 registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator
  • RHSA-2026:53530 Released 2026-08-11 · Red Hat rating Critical
    Multicluster Global Hub 1.7.2 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:53415 Released 2026-08-11 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) opentelemetry-collector-0.152.1-1.el9_6
  • RHSA-2026:53412 Released 2026-08-11 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) opentelemetry-collector-0.152.1-1.el9_4
  • RHSA-2026:53413 Released 2026-08-11 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) opentelemetry-collector-0.152.1-1.el10_0
  • RHSA-2026:47728 Released 2026-08-06 · Red Hat rating Critical
    OpenShift Container Platform 4.17.56 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9 +7
  • RHSA-2026:50843 Released 2026-08-05 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.16
    • Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:48699 Released 2026-08-05 · Red Hat rating Critical
    OpenShift Container Platform 4.18.51 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9 +1
  • RHSA-2026:47952 Released 2026-07-29 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.2.12
    • Logging Subsystem for Red Hat OpenShift 6.2 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:44235 Released 2026-07-29 · Red Hat rating Important
    OpenShift Container Platform 4.19.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +2
  • RHSA-2026:47149 Released 2026-07-28 · Red Hat rating Important
    Multicluster Global Hub 1.7.2 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:44263 Released 2026-07-28 · Red Hat rating Important
    OpenShift Container Platform 4.20.31 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +1
  • RHSA-2026:44622 Released 2026-07-23 · Red Hat rating Important
    Multicluster Global Hub 1.6.4 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:43052 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.12.20
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:42852 Released 2026-07-21 · Red Hat rating Important
    Multicluster Global Hub 1.5.6 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:42796 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.15.6
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:40792 Released 2026-07-21 · Red Hat rating Important
    OpenShift Container Platform 4.21.25 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +1
  • RHSA-2026:42146 Released 2026-07-20 · Red Hat rating Important
    Red Hat Quay 3.12.20
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:41066 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.16.5
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:41031 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.10.24
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:41019 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • RHEM 1.1 for RHEL 10 flightctl-1.1.3-1.el10em, flightctl-agent-1.1.3-1.el10em, flightctl-cli-1.1.3-1.el10em
    • RHEM 1.1 for RHEL 9 flightctl-1.1.3-1.el9em, flightctl-agent-1.1.3-1.el9em, flightctl-cli-1.1.3-1.el9em
  • RHSA-2026:41030 Released 2026-07-16 · Red Hat rating Important
    Multicluster Global Hub 1.4.7 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:40974 Released 2026-07-16 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:40972 Released 2026-07-16 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
  • RHSA-2026:40970 Released 2026-07-16 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/createtree-rhel9
  • RHSA-2026:40945 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:40262 Released 2026-07-15 · Red Hat rating Important
    Red Hat Quay 3.9.24
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:40118 Released 2026-07-15 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:36796 Released 2026-07-08 · Red Hat rating Important
    Red Hat Edge Manager Version 1.0.3 Security Update
    • RHEM 1.0 for RHEL 9 flightctl-1.0.3-1.el9em, flightctl-agent-1.0.3-1.el9em, flightctl-cli-1.0.3-1.el9em +1
  • RHSA-2026:36651 Released 2026-07-08 · Red Hat rating Important
    Red Hat Edge Manager Version 1.0.3 Security Update
    • Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
  • RHSA-2026:34794 Released 2026-07-07 · Red Hat rating Important
    OpenShift Container Platform 4.22.4 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +4
  • RHSA-2026:34359 Released 2026-07-01 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.152.1-1.el9_8
  • RHSA-2026:34357 Released 2026-07-01 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector-0.152.1-1.el10_2
  • RHSA-2026:34364 Released 2026-07-01 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.4.6
    • Logging Subsystem for Red Hat OpenShift 6.4 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +2
  • RHSA-2026:30651 Released 2026-06-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.9 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +18
  • RHSA-2026:29770 Released 2026-06-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentelemetry-collector-contrib-0.155.0-0.1.hum1@aarch64, opentelemetry-collector-contrib-0.155.0-0.1.hum1@src, opentelemetry-collector-contrib-0.155.0-0.1.hum1@x86_64
  • RHSA-2026:25245 Released 2026-06-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentelemetry-collector-0.153.0-1.hum1@aarch64, opentelemetry-collector-0.153.0-1.hum1@src, opentelemetry-collector-0.153.0-1.hum1@x86_64
  • RHSA-2026:25039 Released 2026-06-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images jaeger-2.19.0-1.hum1@aarch64, jaeger-2.19.0-1.hum1@src, jaeger-2.19.0-1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
File Integrity OperatorAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Logging Subsystem for Red Hat OpenShift 6.0Fixed RHSA-2026:50843, RHSA-2026:83013
Logging Subsystem for Red Hat OpenShift 6.2Fixed RHSA-2026:47952
Logging Subsystem for Red Hat OpenShift 6.4Fixed RHSA-2026:34364, RHSA-2026:77639
Logging Subsystem for Red Hat OpenShift 6.5Fixed RHSA-2026:56340, RHSA-2026:70870
Multicluster Global Hub 1.4.9Fixed RHSA-2026:41030
Multicluster Global Hub 1.5.8Fixed RHSA-2026:42852
Multicluster Global Hub 1.6.6Fixed RHSA-2026:44622
Multicluster Global Hub 1.7.4Fixed RHSA-2026:47149, RHSA-2026:53530
OpenShift File Integrity Operator - FIO 1Fixed RHSA-2026:54288
RHEM 1.0 for RHEL 9Fixed RHSA-2026:36796
RHEM 1.1 for RHEL 10Fixed RHSA-2026:41019
RHEM 1.1 for RHEL 9Fixed RHSA-2026:41019
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:67538
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:30651
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:67539
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:67541
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:67542
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Red Hat Edge Manager 1.0Fixed RHSA-2026:36651
Red Hat Edge Manager 1.1Fixed RHSA-2026:40118, RHSA-2026:40945
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:34357
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:34359
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:53412
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:53413
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:53415
Red Hat Hardened ImagesFixed RHSA-2026:25039, RHSA-2026:25245, RHSA-2026:29770
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:59833
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:65840
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:56789
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:56912
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:50758
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:47728
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:48699
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:44235
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:44263
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:40792
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:34794
Red Hat Quay 3.10Fixed RHSA-2026:41031
Red Hat Quay 3.12Fixed RHSA-2026:42146, RHSA-2026:43052
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:42796
Red Hat Quay 3.16Fixed RHSA-2026:41066
Red Hat Quay 3.17Fixed RHSA-2026:74511
Red Hat Quay 3.9Fixed RHSA-2026:40262
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:40970, RHSA-2026:40972, RHSA-2026:40974
Not affected: 58 products
  • File Integrity Operator
  • Logging Subsystem for Red Hat OpenShift 6.0
  • Logging Subsystem for Red Hat OpenShift 6.2
  • Logging Subsystem for Red Hat OpenShift 6.4
  • Logging Subsystem for Red Hat OpenShift 6.5
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Multicluster Global Hub 1.6.6
  • Multicluster Global Hub 1.7.4
  • Network Observability Operator
  • OpenShift File Integrity Operator - FIO 1
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • RHEM 1.0 for RHEL 9
  • RHEM 1.1 for RHEL 10
  • RHEM 1.1 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Data Grid 8
  • Red Hat Edge Manager 1.0
  • Red Hat Edge Manager 1.1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenStack Platform 18.0
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.9
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Debezium 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42154
  2. 2026-10-03 Alias added: GHSA-8rm2-7qqf-34qm
  3. 2026-10-08 Fix available: RHSA-2026:77639 · Red Hat
  4. 2026-10-08 Affected versions changed · Red Hat
  5. 2026-10-10 Affected versions changed · Red Hat
  6. 2026-10-15 Fix available: RHSA-2026:83013 · Red Hat
  7. 2026-10-16 Fix available: Logging Subsystem for Red Hat OpenShift 6.0 · Red Hat
  8. 2026-10-30 Affected versions changed · Red Hat
  9. 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat

References

Patch 2

Advisory 2

Other 3

  • TI-2021-10330 Arbitrary redirects under /new endpoint CVSS 3.1MEDIUM 6.5
  • TI-2026-30481 Prometheus Azure AD remote write OAuth client secret exposed via config API CVSS 3.1HIGH 7.5
  • TI-2019-02838 Cross-site scripting in [UNKNOWN] prometheus CVSS 3.0MEDIUM 6.1
  • TI-2026-28993 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer CVSS 4.0MEDIUM 5.3
  • TI-2026-32778 Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences