This release of Red Hat OpenShift Dev Spaces addresses security vulnerabilities in container base images and Universal Base Image (UBI) dependencies. All Red Hat OpenShift Dev Spaces container images are rebuilt with the latest UBI packages containing fixes for publicly disclosed CVEs.

For details on specific CVEs addressed in Red Hat OpenShift Dev Spaces container images, see the Red Hat security advisories for OpenShift Dev Spaces.

The following CVEs are addressed in this release:

code-rhel9

• CVE-2026-12143: form-data -- Form field override via CRLF injection. (CRW-12379)
• CVE-2026-13149: Brace-expansion -- Denial of Service due to exponential-time complexity. (CRW-11666)
• CVE-2026-41242: protobufjs -- Arbitrary code execution via injected protobuf definition type fields. (CRW-12670)
• CVE-2026-42264: Axios -- Prototype pollution allows information disclosure and request manipulation. (CRW-11639)
• CVE-2026-44705: tmp -- Path Traversal via unsanitized prefix/postfix enables directory escape. (CRW-12260)
• CVE-2026-46681: @nevware21/ts-utils -- Arbitrary Code Execution via Prototype Pollution. (CRW-12110)
• CVE-2026-48068: @grpc/grpc-js -- Server crash via malformed HTTP/2 stream initiation. (CRW-11970)
• CVE-2026-49978: DOMPurify -- Cross-site scripting vulnerability allows code execution. (CRW-11874)
• CVE-2026-59869: js-yaml -- Denial of Service via crafted YAML documents. (CRW-11824)
• CVE-2026-59873: node-tar -- Denial of Service via crafted gzip bomb. (CRW-11759)
• CVE-2026-59874: Node-tar -- Denial of Service via malformed tar archive header. (CRW-11762)
• CVE-2026-59877: protobufjs -- Denial of Service via crafted .proto schema. (CRW-11936)
• CVE-2026-67213: nanoid -- Denial of Service via infinite loop in random ID generation. (CRW-12642)
• CVE-2026-67214: nanoid -- Denial of Service via negative size input in non-secure module functions. (CRW-12673)
• CVE-2026-69152: brace-expansion -- Denial of Service via unbounded intermediate arrays. (CRW-12223)
• CVE-2026-73086: nanoid -- Predictable ID generation due to integer overflow. (CRW-12361)
• CVE-2026-8286: curl -- Insecure connection establishment due to TLS configuration mismatch. (CRW-11694)
• CVE-2026-9277: shell-quote -- Arbitrary code execution via command injection due to unescaped line terminators. (CRW-12134)
• CVE-2026-9547: curl -- Man-in-the-middle attack via SSH host key bypass. (CRW-11686)

configbump-rhel9

• CVE-2026-39820: Go net/mail -- Denial of Service via crafted email inputs. (CRW-11391)
• CVE-2026-42499: net/mail -- Denial of Service via pathological email address parsing. (CRW-11385)

dashboard-rhel9

• CVE-2026-12151: undici -- Denial of Service due to unbounded memory growth via WebSocket frames. (CRW-12297)

multicluster-redirector-rhel9

• CVE-2026-47691: Netty -- Insufficient Bailiwick Validation for NS Records. (CRW-11834)

oauth2-proxy-rhel9

• CVE-2026-34986: Go JOSE -- Denial of Service via crafted JSON Web Encryption (JWE) object. (CRW-11845)

openvsx-rhel9

• CVE-2026-10050: Eclipse Jetty -- Authentication bypass via Digest authentication encoding collision. (CRW-12231)
• CVE-2026-10051: Eclipse Jetty -- Information disclosure due to retained HTTP/1.1 trailers across connections. (CRW-12291)
• CVE-2026-12151: undici -- Denial of Service due to unbounded memory growth via WebSocket frames. (CRW-12296)
• CVE-2026-13149: Brace-expansion -- Denial of Service due to exponential-time complexity. (CRW-11661)
• CVE-2026-40983: Micrometer -- Denial of Service via specially crafted gRPC requests. (CRW-12011)
• CVE-2026-40984: Micrometer -- Denial of Service via specially crafted HTTP requests. (CRW-11783)
• CVE-2026-41695: Spring Data Commons -- Denial of Service via crafted property path strings. (CRW-11594)
• CVE-2026-41716: Spring Data Commons -- Denial of Service due to cache exhaustion via attacker-supplied strings. (CRW-11597)
• CVE-2026-44705: tmp -- Path traversal via unsanitized prefix/postfix enables directory escape. (CRW-12261)
• CVE-2026-45149: brace-expansion -- Denial of Service due to excessive memory allocation when expanding large numeric ranges. (CRW-11454)
• CVE-2026-45416: Netty -- Denial of Service due to eager buffer allocation in TLS handshake. (CRW-12314)
• CVE-2026-45623: PostCSS -- Information disclosure and denial of service via crafted CSS input. (CRW-12159)
• CVE-2026-45674: Netty -- Information disclosure and data manipulation due to improper CNAME record validation. (CRW-12306)
• CVE-2026-49978: DOMPurify -- Cross-site scripting vulnerability allows code execution. (CRW-11881)
• CVE-2026-50010: Netty -- Improper trust manager handling leads to hostname verification bypass. (CRW-12304)
• CVE-2026-50193: Jackson-databind -- Denial of Service via deeply nested JSON processing. (CRW-11568)
• CVE-2026-54399: Apache HttpComponents Core -- Denial of Service via excessive HTTP headers. (CRW-11801)
• CVE-2026-54428: Apache HttpComponents Core -- Denial of Service via oversized HTTP/2 HPACK header blocks. (CRW-11809)
• CVE-2026-54512: jackson-databind -- Arbitrary code execution via PolymorphicTypeValidator bypass. (CRW-11554)
• CVE-2026-55831: Netty -- Denial of Service via SPDY SETTINGS frame processing. (CRW-12024)
• CVE-2026-55833: Netty -- Denial of Service via SPDY header decompression amplification. (CRW-11989)
• CVE-2026-56745: Netty -- Denial of Service via memory exhaustion in SPDY-to-HTTP codec. (CRW-12094)
• CVE-2026-56746: Netty -- Security control bypass allows unauthorized requests via null origin header. (CRW-12076)
• CVE-2026-56819: Netty -- Denial of Service via HTTP/2 DATA frame memory leak. (CRW-12059)
• CVE-2026-59869: js-yaml -- Denial of Service via crafted YAML documents. (CRW-11822)
• CVE-2026-59873: node-tar -- Denial of Service via crafted gzip bomb. (CRW-11751)
• CVE-2026-59874: Node-tar -- Denial of Service via malformed tar archive header. (CRW-11773)
• CVE-2026-59888: jackson-databind -- @JsonIgnore bypass in Java Records. (CRW-12142)
• CVE-2026-59899: Netty -- Memory exhaustion in netty-codec-http (decompression bomb). (CRW-12041)
• CVE-2026-68494: jackson-core -- Denial of Service via incomplete fix in async JSON parser. (CRW-12250)
• CVE-2026-69153: PostCSS -- Information disclosure via crafted sourceMappingURL. (CRW-12203)
• CVE-2026-9563: Eclipse Parsson -- Denial of Service via uncontrolled resource consumption in JSON parsing. (CRW-11768)

pluginregistry-rhel9

• CVE-2026-10050: Eclipse Jetty -- Authentication bypass via Digest authentication encoding collision. (CRW-12232)
• CVE-2026-10051: Eclipse Jetty -- Information disclosure due to retained HTTP/1.1 trailers across connections. (CRW-12292)
• CVE-2026-12151: undici -- Denial of Service due to unbounded memory growth via WebSocket frames. (CRW-12295)
• CVE-2026-13149: Brace-expansion -- Denial of Service due to exponential-time complexity. (CRW-11665)
• CVE-2026-40983: Micrometer -- Denial of Service via specially crafted gRPC requests. (CRW-12010)
• CVE-2026-40984: Micrometer -- Denial of Service via specially crafted HTTP requests. (CRW-11786)
• CVE-2026-41695: Spring Data Commons -- Denial of Service via crafted property path strings. (CRW-11591)
• CVE-2026-41716: Spring Data Commons -- Denial of Service due to cache exhaustion via attacker-supplied strings. (CRW-11600)
• CVE-2026-44705: tmp -- Path traversal via unsanitized prefix/postfix enables directory escape. (CRW-12266)
• CVE-2026-45149: brace-expansion -- Denial of Service due to excessive memory allocation when expanding large numeric ranges. (CRW-11447)
• CVE-2026-45416: Netty -- Denial of Service due to eager buffer allocation in TLS handshake. (CRW-12311)
• CVE-2026-45674: Netty -- Information disclosure and data manipulation due to improper CNAME record validation. (CRW-12309)
• CVE-2026-50010: Netty -- Improper trust manager handling leads to hostname verification bypass. (CRW-12303)
• CVE-2026-50193: Jackson-databind -- Denial of Service via deeply nested JSON processing. (CRW-11571)
• CVE-2026-54399: Apache HttpComponents Core -- Denial of Service via excessive HTTP headers. (CRW-11803)
• CVE-2026-54428: Apache HttpComponents Core -- Denial of Service via oversized HTTP/2 HPACK header blocks. (CRW-11810)
• CVE-2026-54512: jackson-databind -- Arbitrary code execution via PolymorphicTypeValidator bypass. (CRW-11555)
• CVE-2026-55831: Netty -- Denial of Service via SPDY SETTINGS frame processing. (CRW-12025)
• CVE-2026-55833: Netty -- Denial of Service via SPDY header decompression amplification. (CRW-11990)
• CVE-2026-56745: Netty -- Denial of Service via memory exhaustion in SPDY-to-HTTP codec. (CRW-12095)
• CVE-2026-56746: Netty -- Security control bypass allows unauthorized requests via null origin header. (CRW-12077)
• CVE-2026-56819: Netty -- Denial of Service via HTTP/2 DATA frame memory leak. (CRW-12060)
• CVE-2026-59888: jackson-databind -- @JsonIgnore bypass in Java Records. (CRW-12146)
• CVE-2026-59899: Netty -- Memory exhaustion in netty-codec-http (decompression bomb). (CRW-12042)
• CVE-2026-68494: jackson-core -- Denial of Service via incomplete fix in async JSON parser. (CRW-12252)
• CVE-2026-9563: Eclipse Parsson -- Denial of Service via uncontrolled resource consumption in JSON parsing. (CRW-11769)

server-rhel9

• CVE-2026-15075: Eclipse Vert.x -- Information disclosure via improper handling of HTTP 30x redirects. (CRW-11868)
• CVE-2026-15076: Eclipse Vert.x Web Client -- Information disclosure via improper cookie domain validation. (CRW-12123)
• CVE-2026-59888: jackson-databind -- @JsonIgnore bypass in Java Records. (CRW-12147)
• CVE-2026-68494: jackson-core -- Denial of Service via incomplete fix in async JSON parser. (CRW-12253)

traefik-rhel9

• CVE-2026-27136: golang.org/x/net/html -- Cross-Site Scripting via HTML parsing bypass. (CRW-11618)
• CVE-2026-34986: Go JOSE -- Denial of Service via crafted JSON Web Encryption (JWE) object. (CRW-11842)
• CVE-2026-39820: Go net/mail -- Denial of Service via crafted email inputs. (CRW-11390)
• CVE-2026-39831: golang.org/x/crypto/ssh -- Security key bypass due to missing user presence check. (CRW-11716)
• CVE-2026-39835: golang.org/x/crypto/ssh -- Denial of Service via crafted SSH certificate. (CRW-11525)
• CVE-2026-40898: quic-go -- Denial of Service via excessive memory allocation in HTTP/3 trailers. (CRW-11746)
• CVE-2026-42499: net/mail -- Denial of Service via pathological email address parsing. (CRW-11386)
• CVE-2026-46597: golang.org/x/crypto/ssh -- Denial of Service via crafted AES-GCM packet decoder inputs. (CRW-11726)
• CVE-2026-48020: Traefik -- Authentication bypass in StripPrefix middleware allows unauthorized access to protected paths. (CRW-11487)
• CVE-2026-48491: Traefik -- Unauthorized access due to mutual TLS bypass. (CRW-11480)
• CVE-2026-53488: containerd -- Host-root command execution via unvalidated image config labels in CRI plugin. (CRW-11583)
• CVE-2026-53492: containerd -- Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. (CRW-11638)
• CVE-2026-53622: Traefik -- MTLS enforcement bypass due to HTTP/3 TLS configuration flaw. (CRW-11476)
• CVE-2026-54763: Traefik -- Identity spoofing via improper header handling in authentication middlewares. (CRW-11965)
• CVE-2026-65600: Traefik -- Authentication bypass via path traversal in ReplacePathRegex middleware. (CRW-11972)
• CVE-2026-65601: Traefik -- Privilege Escalation via Kubernetes Gateway API Namespace Confusion. (CRW-11962)

udi-rhel9

• CVE-2026-34986: Go JOSE -- Denial of Service via crafted JSON Web Encryption (JWE) object. (CRW-11843)