{"schema":"vulnpedia.research/1","cve":"CVE-2026-111756","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","tags":["x_refsource_CONFIRM","exploit","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-20T17:58:21.005Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-20T17:58:21.005Z","url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"},{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-23T01:59:26.728Z","url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"},{"source":"nvd","sourceId":"CVE-2026-111756","modified":"2026-10-23T02:16:54.423","url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"},{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"},{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","modified":"2026-10-20T18:15:04.527852751Z","url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"}]},{"url":"https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","tags":["x_refsource_MISC","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-20T17:58:21.005Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-20T17:58:21.005Z","url":"https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff"},{"source":"nvd","sourceId":"CVE-2026-111756","modified":"2026-10-23T02:16:54.423","url":"https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff"},{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","url":"https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff"},{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","modified":"2026-10-20T18:15:04.527852751Z","url":"https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff"},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff"}]},{"url":"https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","tags":["x_refsource_MISC","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-20T17:58:21.005Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-20T17:58:21.005Z","url":"https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"},{"source":"nvd","sourceId":"CVE-2026-111756","modified":"2026-10-23T02:16:54.423","url":"https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"},{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","url":"https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"},{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","modified":"2026-10-20T18:15:04.527852751Z","url":"https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"}]},{"url":"https://osv.dev/vulnerability/GHSA-q3jh-wrc6-jgq8","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","modified":"2026-10-20T18:15:04.527852751Z","origins":[{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","url":"https://osv.dev/vulnerability/GHSA-q3jh-wrc6-jgq8"},{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","modified":"2026-10-20T18:15:04.527852751Z","url":"https://osv.dev/vulnerability/GHSA-q3jh-wrc6-jgq8"}]},{"url":"https://github.com/follow-redirects/follow-redirects","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","modified":"2026-10-20T18:15:04.527852751Z","origins":[{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","url":"https://github.com/follow-redirects/follow-redirects"},{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","modified":"2026-10-20T18:15:04.527852751Z","url":"https://github.com/follow-redirects/follow-redirects"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111756","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-111756"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556370","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556370"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111756","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-111756"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88478","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88478"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88537","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88537"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:88541","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://access.redhat.com/errata/RHSA-2026:88541"}]},{"source":"euvd","sourceId":"EUVD-2026-105225","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105225","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-105225","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105225"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","url":"https://osv.dev/vulnerability/GHSA-q3jh-wrc6-jgq8","ecosystem":"npm","name":"follow-redirects","purl":"pkg:npm/follow-redirects","ranges":[{"type":"SEMVER","events":[{"introduced":"1.16.0"},{"fixed":"1.16.1"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-q3jh-wrc6-jgq8/GHSA-q3jh-wrc6-jgq8.json"},"modified":"2026-10-20T18:15:04.527852751Z","origins":[{"source":"ghsa","sourceId":"GHSA-q3jh-wrc6-jgq8","modified":"2026-10-20T18:15:04.527852751Z","url":"https://osv.dev/vulnerability/GHSA-q3jh-wrc6-jgq8"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64","product":"grafana12.4-0:12.4.13-0.3.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:88478"},{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."}],"purl":"pkg:rpm/redhat/grafana12.4@12.4.13-0.3.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src","product":"grafana12.4-0:12.4.13-0.3.hum1@src as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:88478"},{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."}],"purl":"pkg:rpm/redhat/grafana12.4@12.4.13-0.3.hum1?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64","product":"grafana12.4-0:12.4.13-0.3.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:88478"},{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."}],"purl":"pkg:rpm/redhat/grafana12.4@12.4.13-0.3.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"Red Hat Hardened Images:grafana13.1-0:13.1.8-0.4.hum1@aarch64","product":"grafana13.1-0:13.1.8-0.4.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:88537"},{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."}],"purl":"pkg:rpm/redhat/grafana13.1@13.1.8-0.4.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"Red Hat Hardened Images:grafana13.1-0:13.1.8-0.4.hum1@s390x","product":"grafana13.1-0:13.1.8-0.4.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:88537"},{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."}],"purl":"pkg:rpm/redhat/grafana13.1@13.1.8-0.4.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"Red Hat Hardened Images:grafana13.1-0:13.1.8-0.4.hum1@src","product":"grafana13.1-0:13.1.8-0.4.hum1@src as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:88537"},{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."}],"purl":"pkg:rpm/redhat/grafana13.1@13.1.8-0.4.hum1?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"Red Hat Hardened Images:grafana13.1-0:13.1.8-0.4.hum1@x86_64","product":"grafana13.1-0:13.1.8-0.4.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:88537"},{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."}],"purl":"pkg:rpm/redhat/grafana13.1@13.1.8-0.4.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"Red Hat Hardened Images:grafana13.2-0:13.2.4-0.3.hum1@aarch64","product":"grafana13.2-0:13.2.4-0.3.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:88541"},{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."}],"purl":"pkg:rpm/redhat/grafana13.2@13.2.4-0.3.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"Red Hat Hardened Images:grafana13.2-0:13.2.4-0.3.hum1@s390x","product":"grafana13.2-0:13.2.4-0.3.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:88541"},{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."}],"purl":"pkg:rpm/redhat/grafana13.2@13.2.4-0.3.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"Red Hat Hardened Images:grafana13.2-0:13.2.4-0.3.hum1@src","product":"grafana13.2-0:13.2.4-0.3.hum1@src as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:88541"},{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."}],"purl":"pkg:rpm/redhat/grafana13.2@13.2.4-0.3.hum1?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"Red Hat Hardened Images:grafana13.2-0:13.2.4-0.3.hum1@x86_64","product":"grafana13.2-0:13.2.4-0.3.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:88541"},{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."}],"purl":"pkg:rpm/redhat/grafana13.2@13.2.4-0.3.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"red_hat_hardened_images:prometheus3.5.src","product":"prometheus3.5.src as a component of Red Hat Hardened Images","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect — apply the upstream patch to fully remediate."},{"category":"no_fix_planned","details":"Will not fix"}],"purl":"pkg:rpm/redhat/prometheus3.5@3.5.5-0.8.hum1?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]},{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","productId":"red_hat_hardened_images:prometheus3.13.src","product":"prometheus3.13.src as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/prometheus3.13@3.13.4-0.1.hum1?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-111756","modified":"2026-10-23T05:02:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"}]}],"vendorCoverage":{"total":13,"shown":13,"omitted":0,"source":"redhat"}}