Update registry.redhat.io/openshift4/ose-cli-rhel9 Docker digest to cb5c5f7 [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
registry.redhat.io/openshift4/ose-cli-rhel9	stage	digest	ac644e3 → cb5c5f7

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

js-yaml: js-yaml: Denial of Service via crafted YAML documents

CVE-2026-59869

More information

Details

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-59869
• https://bugzilla.redhat.com/show_bug.cgi?id=2498122
• https://www.cve.org/CVERecord?id=CVE-2026-59869
• https://nvd.nist.gov/vuln/detail/CVE-2026-59869
• https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
• https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
• https://github.com/nodeca/js-yaml/releases/tag/3.15.0
• https://github.com/nodeca/js-yaml/releases/tag/4.3.0
• https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m

---

tar: node-tar: Denial of Service via crafted gzip bomb

CVE-2026-59873

More information

Details

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-59873
• https://bugzilla.redhat.com/show_bug.cgi?id=2498120
• https://www.cve.org/CVERecord?id=CVE-2026-59873
• https://nvd.nist.gov/vuln/detail/CVE-2026-59873
• https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3
• https://github.com/isaacs/node-tar/releases/tag/v7.5.19
• https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw

---

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

CVE-2026-14257

More information

Details

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-14257
• https://bugzilla.redhat.com/show_bug.cgi?id=2506433
• https://www.cve.org/CVERecord?id=CVE-2026-14257
• https://nvd.nist.gov/vuln/detail/CVE-2026-14257
• https://github.com/juliangruber/brace-expansion
• https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5
• https://www.npmjs.com/package/brace-expansion

---

github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling

CVE-2026-14362

More information

Details

A flaw was found in HashiCorp memberlist. An attacker with network access to the gossip port could exploit a vulnerability in the push/pull state handling. This could lead to memory exhaustion on a receiving node, causing the process to terminate. This flaw results in a Denial of Service (DoS).

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-14362
• https://bugzilla.redhat.com/show_bug.cgi?id=2498174
• https://www.cve.org/CVERecord?id=CVE-2026-14362
• https://nvd.nist.gov/vuln/detail/CVE-2026-14362
• https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556

---

hypershift: Konnectivity proxy-server accepts agent connections without validating client certificates

CVE-2026-16242

More information

Details

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.

Severity

Critical

References

• https://access.redhat.com/security/cve/CVE-2026-16242
• https://bugzilla.redhat.com/show_bug.cgi?id=2502690
• https://www.cve.org/CVERecord?id=CVE-2026-16242
• https://nvd.nist.gov/vuln/detail/CVE-2026-16242
• https://github.com/openshift/hypershift/pull/9031

---

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

CVE-2026-49978

More information

Details

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a <template>.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.

Severity

Critical

References

• https://access.redhat.com/security/cve/CVE-2026-49978
• https://bugzilla.redhat.com/show_bug.cgi?id=2500695
• https://www.cve.org/CVERecord?id=CVE-2026-49978
• https://nvd.nist.gov/vuln/detail/CVE-2026-49978
• https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff
• https://github.com/cure53/DOMPurify/releases/tag/3.4.7
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq

---

linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability

CVE-2026-48801

More information

Details

A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of O(N²) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-48801
• https://bugzilla.redhat.com/show_bug.cgi?id=2500656
• https://www.cve.org/CVERecord?id=CVE-2026-48801
• https://nvd.nist.gov/vuln/detail/CVE-2026-48801
• https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159
• https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4

---

protobufjs: protobufjs: Denial of Service via crafted .proto schema

CVE-2026-59877

More information

Details

A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library's parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-59877
• https://bugzilla.redhat.com/show_bug.cgi?id=2498127
• https://www.cve.org/CVERecord?id=CVE-2026-59877
• https://nvd.nist.gov/vuln/detail/CVE-2026-59877
• https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217
• https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f
• https://github.com/protobufjs/protobuf.js/pull/2352
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6
• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww

---

ironic-python-agent: OpenStack Ironic Python Agent: Arbitrary code execution via malicious configuration

CVE-2026-66138

More information

Details

A vulnerability was found in Ironic-Python-Agent's (IPA) time syncing code. The value of the ntp_server configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root. This value can be set in three ways; directly in an operator-created ramdisk, set via kernel command line using Ironic, or passing the parameters via mDNS responder for mDNS enabled installation. For the most common, and highest security risk case, this means a Manager role associated with the project set as node.owner may be able to trigger this vulnerability.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-66138
• https://bugzilla.redhat.com/show_bug.cgi?id=2506676
• https://www.cve.org/CVERecord?id=CVE-2026-66138
• https://nvd.nist.gov/vuln/detail/CVE-2026-66138
• https://bugs.launchpad.net/ironic-python-agent/+bug/2160050
• https://launchpad.net/bugs/2160050
• https://opendev.org/openstack/ossa/commit/b6468150ceb59957bfe541d431e90b9651abed51
• https://review.opendev.org/c/openstack/ironic-python-agent/+/998486
• https://security.openstack.org/ossa/OSSA-2026-027.html

---

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

CVE-2026-69152

More information

Details

A flaw was found in the brace-expansion library. The expand() function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-69152
• https://bugzilla.redhat.com/show_bug.cgi?id=2510722
• https://www.cve.org/CVERecord?id=CVE-2026-69152
• https://nvd.nist.gov/vuln/detail/CVE-2026-69152
• https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
• https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
• https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
• https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895

---

nanoid: nanoid: Predictable ID generation due to integer overflow

CVE-2026-73086

More information

Details

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoid(size) function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-73086
• https://bugzilla.redhat.com/show_bug.cgi?id=2514175
• https://www.cve.org/CVERecord?id=CVE-2026-73086
• https://nvd.nist.gov/vuln/detail/CVE-2026-73086
• https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4
• https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3
• https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac
• https://github.com/ai/nanoid/releases/tag/3.3.12
• https://github.com/ai/nanoid/releases/tag/5.1.11
• https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w

---

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

CVE-2026-45623

More information

Details

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifically the first few bytes of file content. Additionally, this vulnerability may be exploited to cause a Denial of Service (DoS) by targeting large files, making the system unavailable.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-45623
• https://bugzilla.redhat.com/show_bug.cgi?id=2507595
• https://www.cve.org/CVERecord?id=CVE-2026-45623
• https://nvd.nist.gov/vuln/detail/CVE-2026-45623
• https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q

---

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

CVE-2026-54272

More information

Details

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery (SSRF) due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassification to bypass network restrictions and potentially access or manipulate internal resources. This vulnerability can be exploited on any dual-stack host for IPv4-mapped addresses, and for NAT64, it requires a NAT64/DNS64 gateway in the deployment network.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-54272
• https://bugzilla.redhat.com/show_bug.cgi?id=2507593
• https://www.cve.org/CVERecord?id=CVE-2026-54272
• https://nvd.nist.gov/vuln/detail/CVE-2026-54272
• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg

---

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

CVE-2026-69153

More information

Details

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-69153
• https://bugzilla.redhat.com/show_bug.cgi?id=2510719
• https://www.cve.org/CVERecord?id=CVE-2026-69153
• https://nvd.nist.gov/vuln/detail/CVE-2026-69153
• https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
• https://github.com/postcss/postcss/releases/tag/8.5.19
• https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp

---

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

CVE-2026-69192

More information

Details

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-69192
• https://bugzilla.redhat.com/show_bug.cgi?id=2510801
• https://www.cve.org/CVERecord?id=CVE-2026-69192
• https://nvd.nist.gov/vuln/detail/CVE-2026-69192
• https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e
• https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1
• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr

---

tar: node-tar: Denial of Service via crafted long-path tar archive

CVE-2026-73566

More information

Details

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the filesFilter function can lead to a stack overflow. This issue results in a denial of service (DoS) by terminating Node.js applications that consume these archives.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-73566
• https://bugzilla.redhat.com/show_bug.cgi?id=2515509
• https://www.cve.org/CVERecord?id=CVE-2026-73566
• https://nvd.nist.gov/vuln/detail/CVE-2026-73566
• https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a
• https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m

---

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

CVE-2026-49978

More information

Details

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a <template>.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-49978
• https://bugzilla.redhat.com/show_bug.cgi?id=2500695
• https://www.cve.org/CVERecord?id=CVE-2026-49978
• https://nvd.nist.gov/vuln/detail/CVE-2026-49978
• https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff
• https://github.com/cure53/DOMPurify/releases/tag/3.4.7
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq

---

fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority

CVE-2026-18446

More information

Details

A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers (URIs) when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion. A remote attacker could exploit this to bypass security policies, such as allowlists or Server-Side Request Forgery (SSRF) filters, potentially redirecting applications to unintended hosts.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-18446
• https://bugzilla.redhat.com/show_bug.cgi?id=2509801
• https://www.cve.org/CVERecord?id=CVE-2026-18446
• https://nvd.nist.gov/vuln/detail/CVE-2026-18446
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.