VDB
RHSA-2026:1000
RHSA-2026:1000
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-rhel9@sha256:fb30b4a5d0007c7ea85e1008302cc5b19b6671f20e66a43da15a1bf4c4075974_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-prometheus-rhel9@sha256:fb30b4a5d0007c7ea85e1008302cc5b19b6671f20e66a43da15a1bf4c4075974_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-config-rhel9-operator@sha256:672cd57b7408021f154ffb4a112206d07c075e6918d12e8e2511d6ca96ce2def_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-cluster-config-rhel9-operator@sha256:672cd57b7408021f154ffb4a112206d07c075e6918d12e8e2511d6ca96ce2def_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:1c7ff8a957041a664e7543f00ad31eb25828b15944f454f1afd80c4a117835ea_s390x as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:1c7ff8a957041a664e7543f00ad31eb25828b15944f454f1afd80c4a117835ea_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-cloud-controller-manager-rhel9-operator@sha256:7743f57cf37c3b0761feb4ee7e8bc4968c42b56c69b0d007b2fa4352124705d3_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-rhel9-operator@sha256:3f4889427d46734578bc9e4c04e6d0730d9e6df97e889703f012447efc480929_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-prometheus-rhel9-operator@sha256:3f4889427d46734578bc9e4c04e6d0730d9e6df97e889703f012447efc480929_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-installer-artifacts-rhel9@sha256:34d7c1c8d0c8d307649e27abae63aab6db4a7475146c48df61fff41ac502108b_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-installer-artifacts-rhel9@sha256:34d7c1c8d0c8d307649e27abae63aab6db4a7475146c48df61fff41ac502108b_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cloud-controller-manager-rhel9@sha256:d800b74d6dd26ef1e3b0f99f5604b4e439929d5f779a9a4ce88d5c44af0d6a2f_s390x as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-openstack-cloud-controller-manager-rhel9@sha256:d800b74d6dd26ef1e3b0f99f5604b4e439929d5f779a9a4ce88d5c44af0d6a2f_s390x |
| Red Hat | registry.redhat.io/openshift4/insights-runtime-extractor-rhel9@sha256:750a032322bae1b3c96a8aa6617451ddccbd41e91374a20dfb0025b5e1ec4033_s390x as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/insights-runtime-extractor-rhel9@sha256:750a032322bae1b3c96a8aa6617451ddccbd41e91374a20dfb0025b5e1ec4033_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-controller-manager-rhel9@sha256:364f170e8d8479c5665324bc090a4b85816a26b29f6cf6c37229bdcec5fd727d_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-openshift-controller-manager-rhel9@sha256:364f170e8d8479c5665324bc090a4b85816a26b29f6cf6c37229bdcec5fd727d_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-vsphere-csi-driver-syncer-rhel9@sha256:33561d01b7c7e3e13779b4be3570019b7a614b04acd8aaf94bee06af294945b3_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-powervs-block-csi-driver-rhel9@sha256:5cbbb4de0c7a51f75443667c20504c37bdf7b8aff6b4e3ee1be648bf21d7d204_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-powervs-block-csi-driver-rhel9@sha256:5cbbb4de0c7a51f75443667c20504c37bdf7b8aff6b4e3ee1be648bf21d7d204_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:5c7c72d75b54cedb182003c76ee921589e8a305c94667a5e48468fb92b112054_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:5c7c72d75b54cedb182003c76ee921589e8a305c94667a5e48468fb92b112054_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-keepalived-ipfailover-rhel9@sha256:3dec8c0f4dddea8fcf8908436f81f27edf465d192e56f7a9affb50b0854da02e_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator@sha256:53df75df702ff3d28e75d31c80b154b8691871cad09f9fe4d8b8587968b26cac_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-container-networking-plugins-rhel9@sha256:29642f6fa24f79b9631e37f328f71817442b6e0b98c55cbf4df51b67f43dc75f_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-container-networking-plugins-rhel9@sha256:29642f6fa24f79b9631e37f328f71817442b6e0b98c55cbf4df51b67f43dc75f_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-nutanix-cloud-controller-manager-rhel9@sha256:74f37add8ffc2ca28249af47ed0b7a424f5e5f36d3890007bacfcedf87469228_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:d9e60591fa14959aec7ec269df348dfca3c14ae744ef992fded6b4f3f924669f_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:d9e60591fa14959aec7ec269df348dfca3c14ae744ef992fded6b4f3f924669f_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-etcd-rhel9@sha256:81078647a13d027b300d6958824ac091ddd3d91d5ec1a3dfbc80046e4fccc155_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-etcd-rhel9@sha256:81078647a13d027b300d6958824ac091ddd3d91d5ec1a3dfbc80046e4fccc155_amd64 |
| Red Hat | registry.redhat.io/openshift4/frr-rhel9@sha256:c6ec3815b7ba3ade69ae4953533032639dbfedfb5c8613764af4928e309e6d0b_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/frr-rhel9@sha256:c6ec3815b7ba3ade69ae4953533032639dbfedfb5c8613764af4928e309e6d0b_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-manila-rhel9@sha256:b00d4d902c4a5652cca3f71aa52733825d68f4a760dad5f97c33689c1dbd78df_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-csi-driver-manila-rhel9@sha256:b00d4d902c4a5652cca3f71aa52733825d68f4a760dad5f97c33689c1dbd78df_ppc64le |
…and 647 more
Timeline
- Jan 27, 2026 CVE Published
- May 13, 2026 CVE Updated
- May 13, 2026 Distribution Patch
- May 13, 2026 Distribution Patch
- May 13, 2026 Security Advisory
- May 13, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:1000 advisory
- https://access.redhat.com/security/cve/CVE-2025-15284 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1000.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2425946 issue
- https://www.cve.org/CVERecord?id=CVE-2025-15284 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-15284 advisory
- https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9 advisory
- https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p advisory