Read the docs
TI-2026-42684 Aliases CVE-2026-59869GHSA-52cp-r559-cp3m

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Priority HIGH 72CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 79 fixed, 25 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.

Summary

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00585 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial js-yaml (nodeca): 3.15.0, 4.3.0js-yaml (npm): 3.15.0, 4.3.0Red Hat: 105 advisoriesRed Hat: 79 fixed, 25 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nodecajs-yaml3.0.0 to before 3.15.0; 4.0.0 to before 4.3.03.15.0, 4.3.0Patch availableCNA
—js-yaml (npm)3.0.0 to before 3.15.03.15.0Patch availableGHSA-52cp-r559-cp3m
—js-yaml (npm)4.0.0 to before 4.3.04.3.0Patch availableGHSA-52cp-r559-cp3m
  • js-yaml Vendornodeca Affected 3.0.0 to before 3.15.0; 4.0.0 to before 4.3.0 Fixed in 3.15.0, 4.3.0 Patch available CNA
  • js-yaml (npm) Vendor— Affected 3.0.0 to before 3.15.0 Fixed in 3.15.0 Patch available GHSA-52cp-r559-cp3m
  • js-yaml (npm) Vendor— Affected 4.0.0 to before 4.3.0 Fixed in 4.3.0 Patch available GHSA-52cp-r559-cp3m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*3.0.0 to before 3.15.0; 4.0.0 to before 4.3.0Vulnerablenodeca
  • cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:* Versions 3.0.0 to before 3.15.0; 4.0.0 to before 4.3.0 Vulnerable ·nodeca

Remediation

  • Fix · CNA js-yaml (nodeca) Fixed in 3.15.0, 4.3.0
  • Fix · GHSA-52cp-r559-cp3m js-yaml (npm) Fixed in 3.15.0 Advisory →
  • Fix · GHSA-52cp-r559-cp3m js-yaml (npm) Fixed in 4.3.0 Advisory →

Red Hat 105 advisories

  • RHSA-2026:82813 Released 2026-10-22 · Red Hat rating Important
    OpenShift Container Platform 4.15.70 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kube-metrics-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel9 +23
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:77316 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.12.100 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8, registry.redhat.io/openshift4/ose-cluster-autoscaler-operator, registry.redhat.io/openshift4/ose-console +5
Show 102 more Red Hat advisories
  • RHSA-2026:77321 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.13.72 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8, registry.redhat.io/openshift4/ose-cluster-autoscaler-operator +10
  • RHSA-2026:73853 Released 2026-10-08 · Red Hat rating Important
    OpenShift Container Platform 4.16.72 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator +17
  • RHSA-2026:73869 Released 2026-10-08 · Red Hat rating Important
    OpenShift Container Platform 4.14.75 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:70587 Released 2026-10-01 · Red Hat rating Important
    OpenShift Container Platform 4.17.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:72722 Released 2026-09-28 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:72712 Released 2026-09-28 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:71114 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.33-1.el8ap, automation-gateway-proxy-server-2.5.10-8.el8ap, automation-gateway-server-2.5.20260923-1.el8ap +3
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.33-1.el9ap, automation-gateway-proxy-server-2.6.17-3.el9ap, automation-gateway-server-2.5.20260923-1.el9ap +3
  • RHSA-2026:71113 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-sqlparse-0.6.0-1.el10ap, python3-sqlparse-0.6.0-1.el10ap, receptor-1.6.8-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.17-1.el9ap, automation-controller-cli-4.7.17-1.el9ap, automation-controller-server-4.7.17-1.el9ap +7
  • RHSA-2026:70829 Released 2026-09-23 · Red Hat rating Important
    RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:69255 Released 2026-09-21 · Red Hat rating Important
    Red Hat Quay 3.16.6
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:68766 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:68762 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:68748 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:68747 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:68681 Released 2026-09-17 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.17 update
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-registry-rhel8, registry.redhat.io/rhmtc/openshift-migration-ui-rhel8
  • RHSA-2026:65852 Released 2026-09-17 · Red Hat rating Important
    OpenShift Container Platform 4.18.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9 +19
  • RHSA-2026:68333 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9 +5
  • RHSA-2026:68254 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:68253 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +10
  • RHSA-2026:68044 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:68006 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:66545 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.6 release and security update
    • Red Hat AMQ Broker 7.13.6
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:66003 Released 2026-09-09 · Red Hat rating Important
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:63307 Released 2026-09-03 · Red Hat rating Important
    Red Hat Quay 3.15.8
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:63142 Released 2026-09-03 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.21.4 security update
    • Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
  • RHSA-2026:60025 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.17.57 security and extras update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9 +1
  • RHSA-2026:60454 Released 2026-09-02 · Red Hat rating Important
    OpenShift Container Platform 4.19.45 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9, registry.redhat.io/openshift4/ose-cli-artifacts-rhel9, registry.redhat.io/openshift4/ose-cluster-kube-scheduler-rhel9-operator +12
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:60446 Released 2026-09-01 · Red Hat rating Important
    OpenShift Container Platform 4.20.36 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9 +18
  • RHSA-2026:60477 Released 2026-09-01 · Red Hat rating Important
    OpenShift Container Platform 4.21.31 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9 +20
  • RHSA-2026:61783 Released 2026-08-31 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
  • RHSA-2026:60387 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:59593 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.17.2 security update
    • multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +6
  • RHSA-2026:59559 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.7 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +15
  • RHSA-2026:59439 Released 2026-08-25 · Red Hat rating Important
    RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +5
  • RHSA-2026:57365 Released 2026-08-25 · Red Hat rating Important
    OpenShift Container Platform 4.22.11 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +6
  • RHSA-2026:57545 Released 2026-08-25 · Red Hat rating Important
    OpenShift Container Platform 4.20.35 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +4
  • RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Important
    rh-podman-desktop security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
  • RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.5 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
  • RHSA-2026:57191 Released 2026-08-19 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
  • RHSA-2026:57013 Released 2026-08-19 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:54547 Released 2026-08-19 · Red Hat rating Important
    OpenShift Container Platform 4.18.53 security and extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9
  • RHSA-2026:54556 Released 2026-08-19 · Red Hat rating Important
    OpenShift Container Platform 4.19.43 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9
  • RHSA-2026:56431 Released 2026-08-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:56366 Released 2026-08-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:54602 Released 2026-08-18 · Red Hat rating Important
    OpenShift Container Platform 4.21.29 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-haproxy-router-rhel9 +6
  • RHSA-2026:54603 Released 2026-08-18 · Red Hat rating Important
    OpenShift Container Platform 4.21.29 security and extras update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9
  • RHSA-2026:54584 Released 2026-08-18 · Red Hat rating Important
    OpenShift Container Platform 4.20.34 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9
  • RHSA-2026:54771 Released 2026-08-18 · Red Hat rating Important
    OpenShift Container Platform 4.22.10 security and extras update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9
  • RHSA-2026:54435 Released 2026-08-12 · Red Hat rating Important
    Streams for Apache Kafka 3.2.1 release and security update
    • Streams for Apache Kafka 3.2.1
  • RHSA-2026:54395 Released 2026-08-12 · Red Hat rating Important
    Red Hat Quay 3.17.4
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:53840 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.15 Images
    • Red Hat Container Native Virtualization 4.15 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53835 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.18 Images
    • Red Hat Container Native Virtualization 4.18 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53789 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.14 Images
    • Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53778 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.20 Images
    • Red Hat Container Native Virtualization 4.20 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53752 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.21 Images
    • Red Hat Container Native Virtualization 4.21 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53736 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.19 Images
    • Red Hat Container Native Virtualization 4.19 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53735 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.13 Images
    • Red Hat Container Native Virtualization 4.13 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53661 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.17 Images
    • Red Hat Container Native Virtualization 4.17 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53520 Released 2026-08-11 · Red Hat rating Important
    Red Hat Quay 3.10.25
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:52968 Released 2026-08-10 · Red Hat rating Important
    Red Hat Quay 3.12.21
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:52768 Released 2026-08-10 · Red Hat rating Important
    Red Hat Developer Hub 1.9.8 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9
  • RHSA-2026:51028 Released 2026-08-06 · Red Hat rating Important
    OpenShift Virtualization v4.22 Images
    • Red Hat Container Native Virtualization 4.22 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:50931 Released 2026-08-05 · Red Hat rating Important
    Red Hat Quay 3.9.25
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:50873 Released 2026-08-05 · Red Hat rating Important
    RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-search-ui-rhel9 +2
  • RHSA-2026:50479 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:50357 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +1
  • RHSA-2026:49689 Released 2026-08-03 · Red Hat rating Important
    Kiali 2.11.15 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:49687 Released 2026-08-03 · Red Hat rating Important
    Kiali 2.4.21 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:49681 Released 2026-08-03 · Red Hat rating Important
    Kiali 2.17.12 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:49680 Released 2026-08-03 · Red Hat rating Important
    Kiali 2.22.8 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:49642 Released 2026-08-03 · Red Hat rating Important
    Red Hat Developer Hub 1.10.3 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:48913 Released 2026-07-30 · Red Hat rating Important
    RHACS 4.10.6 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator
  • RHSA-2026:48891 Released 2026-07-30 · Red Hat rating Important
    RHACS 4.11.2 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9
  • RHSA-2026:48872 Released 2026-07-30 · Red Hat rating Important
    RHACS 4.9.10 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8
  • RHSA-2026:48126 Released 2026-07-29 · Red Hat rating Important
    Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4
  • RHSA-2026:48124 Released 2026-07-29 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.29.1 Release.
    • Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +2
  • RHSA-2026:47949 Released 2026-07-29 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.6.13 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +2
  • RHSA-2026:47737 Released 2026-07-29 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.10 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +6
  • RHSA-2026:47735 Released 2026-07-29 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.8.9 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9 +5
  • RHSA-2026:47451 Released 2026-07-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:47388 Released 2026-07-28 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.10.4 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:44267 Released 2026-07-28 · Red Hat rating Important
    OpenShift Container Platform 4.21.26 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +1
  • RHSA-2026:44263 Released 2026-07-28 · Red Hat rating Important
    OpenShift Container Platform 4.20.31 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +1
  • RHSA-2026:44237 Released 2026-07-28 · Red Hat rating Important
    OpenShift Container Platform 4.22.7 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +1
  • RHSA-2026:46903 Released 2026-07-27 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:46885 Released 2026-07-27 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.10.4 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:46623 Released 2026-07-27 · Red Hat rating Important
    OpenShift Virtualization v4.12 Images
    • Red Hat Container Native Virtualization 4.12 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin
  • RHSA-2026:40415 Released 2026-07-15 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images aspnetcore-runtime-8.0-8.0.28-1.2.hum1@aarch64, aspnetcore-runtime-8.0-8.0.28-1.2.hum1@x86_64, aspnetcore-runtime-dbg-8.0-8.0.28-1.2.hum1@aarch64 +22
  • RHSA-2026:38304 Released 2026-07-12 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images nodejs22-1:22.23.1-2.1.hum1@aarch64, nodejs22-1:22.23.1-2.1.hum1@src, nodejs22-1:22.23.1-2.1.hum1@x86_64 +16
  • RHSA-2026:38236 Released 2026-07-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images nodejs24-1:24.18.0-0.3.hum1@aarch64, nodejs24-1:24.18.0-0.3.hum1@src, nodejs24-1:24.18.0-0.3.hum1@x86_64 +16
  • RHSA-2026:38187 Released 2026-07-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images cargo-1.97.0-1.1.hum1@aarch64, cargo-1.97.0-1.1.hum1@x86_64, clippy-1.97.0-1.1.hum1@aarch64 +36
  • RHSA-2026:37577 Released 2026-07-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images aspnetcore-runtime-8.0-8.0.28-1.1.hum1@aarch64, aspnetcore-runtime-8.0-8.0.28-1.1.hum1@x86_64, aspnetcore-runtime-dbg-8.0-8.0.28-1.1.hum1@aarch64 +22
  • RHSA-2026:37534 Released 2026-07-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images nodejs25-1:25.9.0-1.3.hum1@aarch64, nodejs25-1:25.9.0-1.3.hum1@src, nodejs25-1:25.9.0-1.3.hum1@x86_64 +16
  • RHSA-2026:37532 Released 2026-07-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images nodejs26-1:26.4.0-1.4.hum1@aarch64, nodejs26-1:26.4.0-1.4.hum1@src, nodejs26-1:26.4.0-1.4.hum1@x86_64 +16

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet
Network Observability OperatorAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Directory Server 11AffectedNo fix planned: Will not fix
Red Hat Directory Server 12AffectedNo fix planned: Will not fix
Red Hat Directory Server 13AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 10AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Secrets Management Console for Red Hat OpenShiftAffectedNo fix yet
Cryostat 4 on RHEL 9Fixed RHSA-2026:68333
Red Hat AMQ Broker 7.13.6Fixed RHSA-2026:66545
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:60387
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:47737
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:46903
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:57191
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:48872
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:48891
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:48913
Red Hat Ansible Automation Platform 2.1Fixed RHSA-2026:72712
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:66003, RHSA-2026:72722
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:50357
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:71114
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:71114
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:50479
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:71113
Red Hat Container Native Virtualization 4.12Fixed RHSA-2026:46623
Red Hat Container Native Virtualization 4.13Fixed RHSA-2026:53735
Red Hat Container Native Virtualization 4.14Fixed RHSA-2026:53789
Red Hat Container Native Virtualization 4.15Fixed RHSA-2026:53840
Red Hat Container Native Virtualization 4.17Fixed RHSA-2026:53661
Red Hat Container Native Virtualization 4.18Fixed RHSA-2026:53835
Red Hat Container Native Virtualization 4.19Fixed RHSA-2026:53736
Red Hat Container Native Virtualization 4.20Fixed RHSA-2026:53778
Red Hat Container Native Virtualization 4.21Fixed RHSA-2026:53752
Red Hat Container Native Virtualization 4.22Fixed RHSA-2026:51028
Red Hat Developer Hub 1.10Fixed RHSA-2026:48126, RHSA-2026:49642
Red Hat Developer Hub 1.9Fixed RHSA-2026:52768
Red Hat Discovery 2Fixed RHSA-2026:61783
Red Hat Edge Manager 1.1Fixed RHSA-2026:68044, RHSA-2026:68253
Red Hat Edge Manager 1.2Fixed RHSA-2026:68006, RHSA-2026:68254
Red Hat Enterprise Linux Extensions Channel (v. 10)Fixed RHSA-2026:57590
Red Hat Hardened ImagesFixed RHSA-2026:37532, RHSA-2026:37534, RHSA-2026:37577, RHSA-2026:38187, RHSA-2026:38236, RHSA-2026:38304, RHSA-2026:40415
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:68681
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:77316
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:77321
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:73869
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:82813
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:73853
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:60025, RHSA-2026:70587
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:54547, RHSA-2026:65852
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:54556, RHSA-2026:60454
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:44263, RHSA-2026:54584, RHSA-2026:57545, RHSA-2026:60446
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:44267, RHSA-2026:54602, RHSA-2026:54603, RHSA-2026:60477
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:44237, RHSA-2026:54771, RHSA-2026:57365
Red Hat OpenShift Dev Spaces 3.29Fixed RHSA-2026:48124
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat OpenShift GitOps 1.21Fixed RHSA-2026:63142
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:49687
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:49689
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:49681
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:49680
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:56431
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:56366
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:57013
Red Hat Quay 3.10Fixed RHSA-2026:53520
Red Hat Quay 3.12Fixed RHSA-2026:52968
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:63307
Red Hat Quay 3.16Fixed RHSA-2026:69255
Red Hat Quay 3.17Fixed RHSA-2026:54395
Red Hat Quay 3.9Fixed RHSA-2026:50931
Red Hat Satellite 6.18Fixed RHSA-2026:68762, RHSA-2026:68766
Red Hat Satellite 6.19Fixed RHSA-2026:68747, RHSA-2026:68748
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:59439, RHSA-2026:70829
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:50873
Streams for Apache Kafka 3.2.1Fixed RHSA-2026:54435
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:46885
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:57194
multicluster engine for Kubernetes 2.17Fixed RHSA-2026:59593
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:47949
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:47735
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:59559
Not affected: 78 products
  • Cryostat 4
  • Cryostat 4 on RHEL 9
  • Gatekeeper 3
  • Migration Toolkit for Applications 8
  • OpenShift Service Mesh 3
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Build of Keycloak
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1.10
  • Red Hat Developer Hub 1.9
  • Red Hat Discovery 2
  • Red Hat Edge Manager 1.1
  • Red Hat Edge Manager 1.2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.29
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift GitOps 1.21
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.9
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat Trusted Artifact Signer 1.4
  • Red Hat Trusted Profile Analyzer
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apache Camel for Spring Boot 4
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.17
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59869
  2. 2026-10-03 Alias added: GHSA-52cp-r559-cp3m
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-08 Affected versions changed · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:73853 · Red Hat
  6. 2026-10-09 Fix available: RHSA-2026:73869 · Red Hat
  7. 2026-10-09 Fix available: Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.16 · Red Hat
  8. 2026-10-16 Fix available: RHSA-2026:77316 · Red Hat
  9. 2026-10-16 Fix available: RHSA-2026:77321 · Red Hat
  10. 2026-10-16 Fix available: Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13 · Red Hat
  11. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  12. 2026-10-20 Affected versions changed · Red Hat
  13. 2026-10-22 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:82813 · Red Hat
  15. 2026-10-23 Fix available: Red Hat OpenShift Container Platform 4.15 · Red Hat
  16. 2026-10-26 Affected versions changed · Red Hat
  17. 2026-10-30 Affected versions changed · Red Hat
  18. 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  19. 2026-11-03 Affected versions changed · Red Hat
  20. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 3

  • TI-2026-42685 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing CVSS 3.1HIGH 7.5
  • TI-2026-42683 js-yaml: YAML merge-key chains can force quadratic CPU consumption CVSS 3.1HIGH 7.5
  • TI-2013-04085 The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the… CVSS 2.0MEDIUM 6.8
  • TI-2026-38621 js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases CVSS 3.1MEDIUM 5.3
  • TI-2025-40064 js-yaml has prototype pollution in merge (<<) CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences