An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.Security Fix(es): netty-handler: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) netty-resolver-dns: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) netty-handler: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059) netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043) netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893) netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) io.quarkus/quarkus-vertx-http: Authorization bypass in HTTP path-based policies via encoded characters (CVE-2026-50559) jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860) golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595) golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions (CVE-2026-39828) golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) golang.org/x/net/html: Cross-Site Scripting allowing arbitrary code execution (CVE-2026-25681) golang.org/x/image/tiff: Denial of Service via crafted PackBits-compressed data (CVE-2026-46599) github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder (CVE-2026-46384) github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration (CVE-2026-46385) net: golang: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) mime: golang: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) form-data: Form field override via CRLF injection (CVE-2026-12143) ws: Denial of Service via memory exhaustion from small WebSocket fragments (CVE-2026-48779) ws: Uninitialized memory disclosure via websocket.close() with TypedArray (CVE-2026-45736) undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) js-cookie: Cookie attribute manipulation via prototype pollution (CVE-2026-46625) brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) protobufjs: Denial of Service via crafted schema (CVE-2026-44290) protobufjs: Data integrity impact due to prototype pollution (CVE-2026-44292) protobufjs: Denial of Service via crafted JSON descriptors (CVE-2026-45740) protobufjs: Arbitrary Code Execution via prototype pollution (CVE-2026-44291) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.Security Fix(es): DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization (CVE-2026-41240) crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) shell-quote: Arbitrary code execution via command injection due to unescaped line terminators (CVE-2026-9277) Apache Thrift: Security bypass due to improper certificate validation (CVE-2026-43869) Netty: High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579) Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584) Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581) Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578) Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) Apache Thrift cglib: Denial of Service via specially crafted requests (CVE-2025-48431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Important: Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update

Important: Red Hat build of Cryostat security update

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.Security Fix(es): net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Important: Red Hat build of Cryostat 4.1.1: new RHEL 9 container image security update

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.Security Fix(es): lodash: prototype pollution in .unset and .omit functions (CVE-2025-13465) crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.Security Fix(es): lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566) qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Moderate: Red Hat build of Cryostat 4.1.0: new RHEL 9 container image security update

Important: Red Hat build of Cryostat 4.0.1: new RHEL 9 container image security update

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.Security Fix(es): golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws (CVE-2025-22868) golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

New Red Hat build of Cryostat 4.0.0 on RHEL 9 container images have been released, adding a variety of features and bug fixes.Users of the Red Hat build of Cryostat 3.0.1 on RHEL 8 container images are advised to upgrade to these updated images, which contain backported patches to fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images.Security Fix(es): io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling (CVE-2024-12397) You can find images updated by this advisory in the Red Hat Container Catalog (see the References section).

An update is now available for the Red Hat build of Cryostat 3 on RHEL 8.<br>Security Fix(es):<br><li> golang: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for the Red Hat build of Cryostat 3 on RHEL 8.<br>Security Fix(es):<br><li> golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)</li> <li> golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)</li> <li> golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)</li> <li> com.graphql-java/graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java (CVE-2024-40094)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for the Red Hat build of Cryostat 3 on RHEL 8.Security Fix(es): webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule (CVE-2024-43788) dompurify: XSS vulnerability via prototype pollution (CVE-2024-45801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for the Red Hat build of Cryostat 3 on RHEL 8.Security Fix(es): golang: net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for the Red Hat build of Cryostat 3 on RHEL 8.Security Fix(es): golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788) golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Moderate: Red Hat build of Cryostat 3.0.0: new RHEL 8 container image security update

An update is now available for the Red Hat build of Cryostat 2 on RHEL 8.<br>Security Fix(es):<br><li> vert.x: io.vertx/vertx-core: memory leak due to the use of Netty FastThreadLocal data structures in Vertx (CVE-2024-1023)</li> <li> vertx-core: io.vertx:vertx-core: memory leak when a TCP server is configured with TLS and SNI support (CVE-2024-1300)</li> <li> golang: net/<a href="http:" target="blank">http:</a> memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)</li> <li> golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)</li> <li> golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)</li> <li> netty-codec-<a href="http:" target="blank">http:</a> Allocation of Resources Without Limits or Throttling (CVE-2024-29025)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for the Red Hat build of Cryostat 2 on RHEL 8.<br>Security Fix(es):<br><li> parsson: Denial of Service due to large number parsing (CVE-2023-4043)</li> <li> golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Moderate: Red Hat build of Cryostat 2.4.0: new RHEL 8 container images

An update is now available for Cryostat 2 on RHEL 8.Security Fix(es): golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) golang.org/x/net/html: Cross site scripting (CVE-2023-3978) golang: net/http: insufficient sanitization of Host header (CVE-2023-29406) golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409) golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321) golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Moderate: Red Hat build of Cryostat 2.3.0: new RHEL 8 container images

The RHEL-8 based Cryostat container images have been updated with a security fix for "CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache".Users of RHEL-8 based Cryostat container images are advised to upgrade to these updated images, which contain backported patches to correct this security issue. Users of these images are also encouraged to rebuild all container images that depend on these images.You can find images updated by this advisory in Red Hat Ecosystem Catalog (see References).