Red Hat Product Errata RHSA-2026:68333 - Security Advisory Issued: 2026-09-16 Updated: 2026-09-16 RHSA-2026:68333 - Security Advisory Overview Updated Images Synopsis Important: Red Hat build of Cryostat security update Type/Severity Security Advisory: Important Topic An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Security Fix(es): Apache HttpComponents Core: Denial of Service via excessive HTTP headers (CVE-2026-54399) Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks (CVE-2026-54428) Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects (CVE-2026-15075) Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation (CVE-2026-15076) SeaweedFS: Information disclosure via S3 API gateway path traversal (CVE-2026-55874) SeaweedFS: Unauthorized data deletion via path traversal in S3 gateway (CVE-2026-58372) protobufjs: Denial of Service via crafted .proto schema (CVE-2026-59877) Quarkus REST: Unbounded multipart MIME part-header accumulation allows remote OOM denial of service (CVE-2026-16308) Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833) Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831) Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message (CVE-2026-55851) Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec (CVE-2026-56745) Netty: Security control bypass allows unauthorized requests via null origin header (CVE-2026-56746) Netty: Denial of Service via HTTP/2 DATA frame memory leak (CVE-2026-56819) Netty: Memory exhaustion in netty-codec-http (decompression bomb) (CVE-2026-59899) Apache Thrift: Denial of Service via integer overflow or wraparound (CVE-2026-55969) Apache Thrift: Denial of Service via improper handling of highly compressed data (CVE-2026-48586) Apache Thrift: Denial of Service due to uncontrolled resource allocation (CVE-2026-45112) brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVE-2026-69152) ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494) DOMPurify: Cross-site scripting vulnerability allows code execution (CVE-2026-49978) OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) Go net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) Go encoding/xml: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) Go crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869) golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions (CVE-2026-56854) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Affected Products Cryostat 4 x86_64 Fixes BZ - 2484830 - CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers BZ - 2495031 - CVE-2026-58372 github.com/seaweedfs/seaweedfs: SeaweedFS: Unauthorized data deletion via path traversal in S3 gateway BZ - 2496101 - CVE-2026-54399 org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers BZ - 2496106 - CVE-2026-54428 org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks BZ - 2498092 - CVE-2026-55874 SeaweedFS: github.com/seaweedfs/seaweedfs: SeaweedFS: Information disclosure via S3 API gateway path traversal BZ - 2498122 - CVE-2026-59869 js-yaml: js-yaml: Denial of Service via crafted YAML documents BZ - 2498127 - CVE-2026-59877 protobufjs: protobufjs: Denial of Service via crafted .proto schema BZ - 2499914 - CVE-2026-15076 io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation BZ - 2499919 - CVE-2026-15075 vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects BZ - 2500695 - CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution BZ - 2503101 - CVE-2026-55833 netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification BZ - 2503103 - CVE-2026-55831 io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing BZ - 2505422 - CVE-2026-56746 io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header BZ - 2505698 - CVE-2026-55851 io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message BZ - 2505911 - CVE-2026-56745 netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec BZ - 2505980 - CVE-2026-56819 io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak BZ - 2506373 - CVE-2026-16308 io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service BZ - 2507433 - CVE-2026-55969 thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound BZ - 2507434 - CVE-2026-48586 thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data BZ - 2507439 - CVE-2026-45112 thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation BZ - 2507482 - CVE-2026-59899 io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) BZ - 2510722 - CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation BZ - 2510801 - CVE-2026-69192 ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass BZ - 2511026 - CVE-2026-68494 com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages BZ - 2515840 - CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue BZ - 2525639 - CVE-2026-56854 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions CVEs CVE-2026-1965 CVE-2026-3783 CVE-2026-5704 CVE-2026-6653 CVE-2026-8286 CVE-2026-9547 CVE-2026-11822 CVE-2026-11824 CVE-2026-11940 CVE-2026-11979 CVE-2026-13757 CVE-2026-14164 CVE-2026-15075 CVE-2026-15076 CVE-2026-16118 CVE-2026-16308 CVE-2026-16730 CVE-2026-18477 CVE-2026-18508 CVE-2026-28420 CVE-2026-33818 CVE-2026-39820 CVE-2026-41178 CVE-2026-41989 CVE-2026-41991 CVE-2026-41992 CVE-2026-42499 CVE-2026-45112 CVE-2026-45409 CVE-2026-48586 CVE-2026-49978 CVE-2026-50219 CVE-2026-52859 CVE-2026-54371 CVE-2026-54399 CVE-2026-54411 CVE-2026-54428 CVE-2026-55831 CVE-2026-55833 CVE-2026-55851 CVE-2026-55874 CVE-2026-55892 CVE-2026-55969 CVE-2026-56132 CVE-2026-56392 CVE-2026-56745 CVE-2026-56746 CVE-2026-56819 CVE-2026-56853 CVE-2026-56854 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-58055 CVE-2026-58372 CVE-2026-59857 CVE-2026-59869 CVE-2026-59877 CVE-2026-59899 CVE-2026-60589 CVE-2026-61308 CVE-2026-68494 CVE-2026-69152 CVE-2026-69192 CVE-2026-70907 CVE-2026-73072 CVE-2026-73076 CVE-2026-73077 CVE-2026-73078 References https://access.redhat.com/security/updates/classification/#important aarch64 cryostat/cryostat-agent-init-rhel9@sha256:bc47200b2bb00c9cb4f4ae4929d0faca3b7685ba160bafe07f773e8cfe977b6e cryostat/cryostat-db-rhel9@sha256:0bcd6d1e5fd1dc893c83641c96ebcdaf27fd576cd150d7c53a79ec99cd0581be cryostat/cryostat-grafana-dashboard-rhel9@sha256:8d67c1c76672ecb9241469355656c751bd8b54c138d6fb16866d604bb6da95ed cryostat/cryostat-openshift-console-plugin-rhel9@sha256:a1c2dfa85f82dd2bd96853270cd46de8dcffe4f6f81e7646eeb032843884ff94 cryostat/cryostat-operator-bundle@sha256:01b7df9a63ddcffaca5f4594da01b1d0cb03fb4c0db8061266a67f027a67393b cryostat/cryostat-reports-rhel9@sha256:56942fe083a729c20c316899678a9b8bcb53d7cd0166bf1d026e71e7d69aee86 cryostat/cryostat-rhel9@sha256:4d1c6cfbce9d2a106ff1d14681fdc51d00b203f057d66e5023067b04d3429d20 cryostat/cryostat-rhel9-operator@sha256:a6932f33459645777f557163dd24c2d7dfd11bda60