SB20260731138 - Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.11



SB20260731138 - Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.11

Published: July 31, 2026

Security Bulletin ID SB20260731138
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2026-42504)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in WordDecoder.DecodeHeader in the mime package when parsing a maliciously crafted MIME header containing many invalid encoded-words. A remote attacker can send a specially crafted MIME header to cause a denial of service.


2) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-13149)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in expand() when processing attacker-influenced brace expansion patterns containing consecutive non-expanding {} groups. A remote attacker can send a specially crafted input string to cause a denial of service.

The issue can block the calling thread for minutes or indefinitely with a small all-ASCII input, and applications using Node's single-threaded event loop may fully stall a worker or process.


3) Link following (CVE-ID: CVE-2026-39822)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to access files outside the intended root directory.

The vulnerability exists due to improper link resolution in os.Root file-opening functions when processing a path whose final component is a symbolic link and the path ends with a trailing slash. A local user can supply a crafted path to access files outside the intended root directory.

This issue affects Unix systems.


4) Cross-site scripting (CVE-ID: CVE-2026-49978)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to cross-site scripting in template content sanitization when processing HTML containing a template element with an attached shadow root inside template.content. A remote attacker can supply crafted HTML that survives sanitization to execute arbitrary script in the victim's browser.

Exploitation occurs when the application clones the template and inserts the result into the page.


5) Resource exhaustion (CVE-ID: CVE-2026-59869)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the js-yaml parser when parsing YAML documents containing chained merge keys. A remote attacker can send a specially crafted YAML document to cause a denial of service.

The issue results in quadratic CPU consumption for input whose size grows only linearly.


Remediation

Install update from vendor's website.