VDB

RHSA-2026:74609

RHSA-2026:74609 PUBLISHED CVSS 5.5 MEDIUM

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).

Risk Scores

CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected Products

VendorProductVersions
Red Hatregistry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:1f07346cd7a9add89abf2f1b2095b5bc55cb83bdfc29b7c1e046d0f3f40d6335_s390x as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f7c23fcc84c59bfda30418a8b20f700e116df9b7367c86a6cdcaffaf59b85516_ppc64le as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel9@sha256:4459676a03c91537b96bf264c95bf918ab2debc8d5e483bf39041ddb0811f291_ppc64le as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:dbbfddeff933aadd7260d786c33d966f48ea72945f2d34b4d40914bb4fadc954_amd64 as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:795d1b20e846376dd6605224dc8956e3a764344601ae126a287562a70aa9ce47_s390x as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:a9ec40ac7c184197b401913f5bfc2b3e964e7f0b0b5b9208b0c781354bf8f7bd_amd64 as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9@sha256:53542c8a3b5ee318edb96ea3d306cf3fd72db7a5e225f3097eff261abc98fdd0_amd64 as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:c2711d0ce151166942b2abeadfec3980a9ba345291df3ea0d052a82caa9ba794_amd64 as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:6a81c6ba5c6c197e116829cca39bb16e2cfa197a7de78d1fb3faaceca364a058_amd64 as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/prometheus-rhel9@sha256:e8bc0b562f346f4a1f6c7676f25708494b8588ac01781c0d06009ce32794807a_arm64 as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:871a7f79694559b0908c9744736069b4c741fce1d3faa114199107208ea8bf7f_s390x as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/logging-console-plugin-pf5-rhel9@sha256:03615ce87700a8923bf9f06be5ea6bc9afebdb1ee6bfc78bff8638d22ca46b54_ppc64le as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:f46f950a2726714dbbac66acbebaa2136aeffa9932b6145279c66d316bc3b833_amd64 as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/thanos-rhel9@sha256:0d6d98a24b7ad31baf266d2bdafbe774fca7f3513cba712dd1bacb0a59cd5aa2_s390x as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel9@sha256:6edc3cb243dabbd2a22e0ebeeda2185dd4b8c64c96bf547437a7ffdaf2cb8a75_s390x as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/monitoring-console-plugin-pf5-rhel9@sha256:9967e5f284cf61cb58a739dd0d8f803a797fa3f55512e4a35cd98443a77ecf09_ppc64le as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/logging-console-plugin-rhel9@sha256:2d8dc6bf4a11fea7bc87a0a4ceb8277b6eafbf50f67089393db8ce6f1f58c775_arm64 as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:8cfe9dcb648bec4490153db0a3a8d70dcf5fad4d6d8d13936c8311f5581012e6_ppc64le as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/logging-console-plugin-pf4-rhel9@sha256:395c6fe490676e1243de546918aef9c3dad33b94e89ee82c43f30bee12108742_ppc64le as a component of Cluster Observability Operator 1.5.3*
Red Hatregistry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:2e5ca6c5f3ffb09af7e515720b743a9199e59bc0cd9d9cb2393d70db5c9fb46d_ppc64le as a component of Cluster Observability Operator 1.5.3*

…and 77 more

Timeline

  • Oct 1, 2026 CVE Published
  • Oct 26, 2026 CVE Updated
  • Oct 26, 2026 Distribution Patch
  • Oct 26, 2026 Distribution Patch
  • Oct 26, 2026 Security Advisory
  • Oct 26, 2026 Security Advisory
  • Oct 26, 2026 Security Advisory
  • Oct 26, 2026 Security Advisory
  • Oct 26, 2026 Security Advisory
  • Oct 26, 2026 Security Advisory
  • Oct 26, 2026 Security Advisory
  • Oct 26, 2026 Security Advisory

References

…and 130 more

Open in Interactive Console →
$ Console Community · 50/day Open console ›