Read the docs
TI-2026-57986 Aliases CVE-2026-84375GHSA-2883-xcg3-v3hh

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 48 fixed, 32 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00541 45th percentileScored 2026-11-07
Fix Partial js-yaml (nodeca): 3.15.2, 4.3.2, 5.4.1js-yaml (npm): 4.3.2, 3.15.2Red Hat: 59 advisoriesRed Hat: 48 fixed, 32 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nodecajs-yaml3.0.0 to before 3.15.2; 4.0.0 to before 4.3.2; 5.0.0 to before 5.4.13.15.2, 4.3.2, 5.4.1Patch availableCNA
—js-yaml (npm)4.0.0 to before 4.3.24.3.2Patch availableGHSA-2883-xcg3-v3hh
—js-yaml (npm)3.0.0 to before 3.15.23.15.2Patch availableGHSA-2883-xcg3-v3hh
  • js-yaml Vendornodeca Affected 3.0.0 to before 3.15.2; 4.0.0 to before 4.3.2; 5.0.0 to before 5.4.1 Fixed in 3.15.2, 4.3.2, 5.4.1 Patch available CNA
  • js-yaml (npm) Vendor— Affected 4.0.0 to before 4.3.2 Fixed in 4.3.2 Patch available GHSA-2883-xcg3-v3hh
  • js-yaml (npm) Vendor— Affected 3.0.0 to before 3.15.2 Fixed in 3.15.2 Patch available GHSA-2883-xcg3-v3hh

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:*:*:*——nodeca
  • cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:*:*:* Versions — — ·nodeca

Remediation

  • Fix · CNA js-yaml (nodeca) Fixed in 3.15.2, 4.3.2, 5.4.1
  • Fix · GHSA-2883-xcg3-v3hh js-yaml (npm) Fixed in 4.3.2 Advisory →
  • Fix · GHSA-2883-xcg3-v3hh js-yaml (npm) Fixed in 3.15.2 Advisory →

Red Hat 59 advisories

  • RHSA-2026:95887 Released 2026-11-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 security update
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:95591 Released 2026-11-05 · Red Hat rating Important
    Cluster Observability Operator - 1.5
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +16
  • RHSA-2026:95081 Released 2026-11-04 · Red Hat rating Important
    Cluster Observability Operator - 1.5
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +16
Show 56 more Red Hat advisories
  • RHSA-2026:93951 Released 2026-11-02 · Red Hat rating Important
    OpenShift Virtualization v4.17 Images
    • Red Hat Container Native Virtualization 4.17 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:93761 Released 2026-11-02 · Red Hat rating Moderate
    OpenShift Virtualization v4.22 Images
    • Red Hat Container Native Virtualization 4.22 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:92650 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.26 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:92307 Released 2026-10-29 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.14 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +16
  • RHSA-2026:90337 Released 2026-10-26 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.21.6 security update
    • Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
  • RHSA-2026:83481 Released 2026-10-21 · Red Hat rating Important
    OpenShift Container Platform 4.19.52 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9, registry.redhat.io/openshift4/ose-local-storage-diskmaker-rhel9 +4
  • RHSA-2026:83542 Released 2026-10-20 · Red Hat rating Moderate
    OpenShift Container Platform 4.22.19 security and extras update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9
  • RHSA-2026:83703 Released 2026-10-20 · Red Hat rating Important
    OpenShift Container Platform 4.21.39 security and extras update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9 +6
  • RHSA-2026:83503 Released 2026-10-20 · Red Hat rating Important
    OpenShift Container Platform 4.20.43 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9, registry.redhat.io/openshift4/ose-local-storage-diskmaker-rhel9 +5
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83598 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:79040 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.18.57 security and extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator
  • RHSA-2026:82151 Released 2026-10-13 · Red Hat rating Critical
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
  • RHSA-2026:79088 Released 2026-10-08 · Red Hat rating Critical
    Red Hat Developer Hub 1.10.5 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:76788 Released 2026-10-06 · Red Hat rating Critical
    Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:72722 Released 2026-09-28 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:72712 Released 2026-09-28 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:71210 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8 +4
  • RHSA-2026:71179 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
  • RHSA-2026:71113 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-sqlparse-0.6.0-1.el10ap, python3-sqlparse-0.6.0-1.el10ap, receptor-1.6.8-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.17-1.el9ap, automation-controller-cli-4.7.17-1.el9ap, automation-controller-server-4.7.17-1.el9ap +7
  • RHSA-2026:70593 Released 2026-09-23 · Red Hat rating Important
    Network Observability 1.12.3 for OpenShift
    • Network Observability (NETOBSERV) 1.12.3 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-pf5-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:70047 Released 2026-09-22 · Red Hat rating Moderate
    OpenShift Virtualization v4.12 Images
    • Red Hat Container Native Virtualization 4.12 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin
  • RHSA-2026:70027 Released 2026-09-22 · Red Hat rating Moderate
    OpenShift Virtualization v4.16 Images
    • Red Hat Container Native Virtualization 4.16 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:69998 Released 2026-09-22 · Red Hat rating Moderate
    OpenShift Virtualization v4.14 Images
    • Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:69289 Released 2026-09-21 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:69255 Released 2026-09-21 · Red Hat rating Important
    Red Hat Quay 3.16.6
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:68766 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:68762 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:68754 Released 2026-09-17 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.1 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +2
  • RHSA-2026:68748 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:68747 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:68695 Released 2026-09-17 · Red Hat rating Important
    Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4
    • Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator
  • RHSA-2026:68690 Released 2026-09-17 · Red Hat rating Important
    Kiali 2.22.10 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:68691 Released 2026-09-17 · Red Hat rating Important
    Kiali 2.17.14 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:68689 Released 2026-09-17 · Red Hat rating Important
    Kiali 2.11.17 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:68687 Released 2026-09-17 · Red Hat rating Important
    Kiali 2.4.23 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:68681 Released 2026-09-17 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.17 update
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-registry-rhel8, registry.redhat.io/rhmtc/openshift-migration-ui-rhel8
  • RHSA-2026:68254 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:68253 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +10
  • RHSA-2026:68044 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:68006 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:67724 Released 2026-09-16 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-ui-rhel9
  • RHSA-2026:67714 Released 2026-09-15 · Red Hat rating Important
    RHACS 4.11.4 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9 +1
  • RHSA-2026:67711 Released 2026-09-15 · Red Hat rating Important
    RHACS 4.10.8 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2026:67279 Released 2026-09-14 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +7
  • RHSA-2026:66084 Released 2026-09-09 · Red Hat rating Important
    Red Hat Quay 3.10.26
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:63165 Released 2026-09-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images grafana13.1-13.1.3-0.5.hum1@aarch64, grafana13.1-13.1.3-0.5.hum1@src, grafana13.1-13.1.3-0.5.hum1@x86_64
  • RHSA-2026:63164 Released 2026-09-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images grafana13.2-13.2.1-0.1.hum1@aarch64, grafana13.2-13.2.1-0.1.hum1@src, grafana13.2-13.2.1-0.1.hum1@x86_64
  • RHSA-2026:62813 Released 2026-09-02 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.0-0.1.4.hum1@aarch64, grafana13.2-13.2.0-0.1.4.hum1@src, grafana13.2-13.2.0-0.1.4.hum1@x86_64
  • RHSA-2026:62810 Released 2026-09-02 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.9-0.5.hum1@aarch64, grafana12.4-12.4.9-0.5.hum1@src, grafana12.4-12.4.9-0.5.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Ansible Automation Orchestrator 2026AffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Ceph Storage 4AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Directory Server 11AffectedNo fix planned: Will not fix
Red Hat Directory Server 12AffectedNo fix planned: Will not fix
Red Hat Directory Server 13AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Secrets Management Console for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Cluster Observability Operator 1.5Fixed RHSA-2026:95081, RHSA-2026:95591
Network Observability (NETOBSERV) 1.12.3Fixed RHSA-2026:70593
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:92307
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:67714
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:67711
Red Hat Ansible Automation Platform 2.1Fixed RHSA-2026:72712
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:72722, RHSA-2026:82151
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:71210
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:71179
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:71113
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:67279
Red Hat Container Native Virtualization 4.12Fixed RHSA-2026:70047
Red Hat Container Native Virtualization 4.14Fixed RHSA-2026:69998
Red Hat Container Native Virtualization 4.16Fixed RHSA-2026:70027
Red Hat Container Native Virtualization 4.17Fixed RHSA-2026:93951
Red Hat Container Native Virtualization 4.22Fixed RHSA-2026:93761
Red Hat Developer Hub 1.10Fixed RHSA-2026:76788, RHSA-2026:79088
Red Hat Discovery 2Fixed RHSA-2026:69289
Red Hat Edge Manager 1.1Fixed RHSA-2026:68044, RHSA-2026:68253
Red Hat Edge Manager 1.2Fixed RHSA-2026:68006, RHSA-2026:68254
Red Hat Hardened ImagesFixed RHSA-2026:62810, RHSA-2026:62813, RHSA-2026:63164, RHSA-2026:63165
Red Hat JBoss Enterprise Application Platform 8.1Fixed RHSA-2026:95887
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:68681
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:67724
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734, RHSA-2026:92510
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:79040
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:83481
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:83503
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:83703
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:83542
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:68754
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat OpenShift GitOps 1.21Fixed RHSA-2026:90337
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:68687
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:68689
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:68691
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:68690
Red Hat OpenShift Service Mesh 3.4Fixed RHSA-2026:68695
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:92650
Red Hat Quay 3.10Fixed RHSA-2026:66084
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.16Fixed RHSA-2026:69255
Red Hat Satellite 6.18Fixed RHSA-2026:68762, RHSA-2026:68766
Red Hat Satellite 6.19Fixed RHSA-2026:68747, RHSA-2026:68748
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:83598
Not affected: 53 products
  • Cluster Observability Operator 1.5
  • Cryostat 4
  • Gatekeeper 3
  • Network Observability (NETOBSERV) 1.12.3
  • OpenShift Service Mesh 3
  • Red Hat 3scale API Management Platform 2
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Build of Keycloak
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1.10
  • Red Hat Discovery 2
  • Red Hat Edge Manager 1.1
  • Red Hat Edge Manager 1.2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Migration Toolkit 1.8
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat OpenShift GitOps 1.21
  • Red Hat OpenShift Service Mesh 3.4
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Quay 3.10
  • Red Hat Quay 3.14
  • Red Hat Quay 3.16
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Artifact Signer 1.4
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84375
  2. 2026-10-03 Alias added: GHSA-2883-xcg3-v3hh
  3. 2026-10-07 Fix available: RHSA-2026:76788 · Red Hat
  4. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  5. 2026-10-07 Fix available: Red Hat Developer Hub 1.10 · Red Hat
  6. 2026-10-08 Affected versions changed · Red Hat
  7. 2026-10-09 Fix available: RHSA-2026:79088 · Red Hat
  8. 2026-10-09 Affected versions changed · Red Hat
  9. 2026-10-13 Affected versions changed · Red Hat
  10. 2026-10-13 Fix available: RHSA-2026:82151 · Red Hat
  11. 2026-10-16 Fix available: RHSA-2026:79040 · Red Hat
  12. 2026-10-16 Fix available: RHSA-2026:83598 · Red Hat
  13. 2026-10-16 Fix available: Red Hat OpenShift Container Platform 4.18, Red Hat Trusted Artifact Signer 1.4 · Red Hat
  14. 2026-10-20 Fix available: RHSA-2026:83542 · Red Hat
  15. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  16. 2026-10-20 Fix available: RHSA-2026:83503 · Red Hat
  17. 2026-10-20 Fix available: RHSA-2026:83703 · Red Hat
  18. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Container Platform 4.21 +1 · Red Hat
  19. 2026-10-21 Fix available: RHSA-2026:83481 · Red Hat
  20. 2026-10-21 Fix available: Red Hat OpenShift Container Platform 4.19 · Red Hat
  21. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  22. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  23. 2026-10-23 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
  24. 2026-10-29 Affected versions changed · Red Hat
  25. 2026-10-30 Fix available: RHSA-2026:90337 · Red Hat
  26. 2026-10-30 Fix available: RHSA-2026:92307 · Red Hat
  27. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  28. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  29. 2026-10-30 Fix available: Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat OpenShift Dev Spaces 3.31, Red Hat OpenShift GitOps 1.21 · Red Hat
  30. 2026-10-30 Affected versions changed · Red Hat
  31. 2026-10-31 Fix available: RHSA-2026:92650 · Red Hat
  32. 2026-10-31 Fix available: Red Hat Openshift Data Foundation 4.19 · Red Hat
  33. 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  34. 2026-11-03 Fix available: RHSA-2026:93761 · Red Hat
  35. 2026-11-03 Fix available: RHSA-2026:93951 · Red Hat
  36. 2026-11-03 Fix available: Red Hat Container Native Virtualization 4.17, Red Hat Container Native Virtualization 4.22 · Red Hat
  37. 2026-11-04 Fix available: RHSA-2026:95081 · Red Hat
  38. 2026-11-04 Fix available: Cluster Observability Operator 1.5, Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
  39. 2026-11-06 Fix available: RHSA-2026:95591 · Red Hat
  40. 2026-11-06 Affected versions changed · Red Hat
  41. 2026-11-06 Fix available: RHSA-2026:95887 · Red Hat
  42. 2026-11-06 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat

References

Advisory 1

Other 9

  • TI-2026-66141 probe-image-size: Quadratic-time Denial of Service in the SVG Parser CVSS 3.1HIGH 7.5
  • TI-2026-51727 js-yaml: Exponential parsing time in the flow collections leads to denial of service CVSS 3.1HIGH 7.5
  • TI-2026-42685 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing CVSS 3.1HIGH 7.5
  • TI-2026-42684 js-yaml: YAML merge-key chains can force quadratic CPU consumption CVSS 3.1HIGH 7.5
  • TI-2026-42683 js-yaml: YAML merge-key chains can force quadratic CPU consumption CVSS 3.1HIGH 7.5
  • TI-2013-04085 The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the… CVSS 2.0MEDIUM 6.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences