Advisory severityLow3.7Red Hat Linux Updated

Low [CVE-2026-110910] Query parameter injection via unencoded empty array keys

This low-severity Red Hat Linux advisory covers CVE-2026-110910; related products: Ansible Automation Orchestrator 2026, Cost Management On Premise, Cryostat 4.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-110910 Source published Oct 27, 2026Source updated Oct 27, 2026

VulniPulse record published Oct 29, 2026Record updated Oct 30, 2026

CVE-2026-110910

Get an email when Red Hat Linux publishes the next one.

VulniPulse checks Red Hat Linux's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

Summary

Query parameter injection via unencoded empty array keys. Red Hat rates this low (CVSS 3.7).

Weakness: CWE-140.

Affected products named by the advisory: Ansible Automation Orchestrator 2026; Cost Management On Premise; Cryostat 4; Migration Toolkit for Applications 8; and 34 more.

Affected products named by the advisory: Migration Toolkit for Containers; Multicluster Engine for Kubernetes; Node HealthCheck Operator; OpenShift Lightspeed; and 30 more.

Affected versions

< 6.12.0
< 6.12.6
< 12.6
< 6.13.0
< 6.13.4
< 13.4
< 6.14.0
< 6.14.3
< 14.3
< 6.15.0
< 6.15.4
< 15.4
< 6.16.0
< 6.16.2
< 16.2
< 17.0

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

Fixed versions

6.12.0
6.12.6
12.6
6.13.0
6.13.4
13.4
6.14.0
6.14.3
14.3
6.15.0
6.15.4
15.4
6.16.0
6.16.2
16.2
17.0

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Ensure allowEmptyArrays remains set to its default value (false) when serializing objects derived from untrusted input. If empty array support is required, sanitize or validate object keys prior to serialization to reject or escape URL delimiter characters (&, =, #).

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

All Red Hat Linux advisories

Sources

Official and corroborating records used to build this advisory.

Red Hat Security Data APIofficial
Official vendor source used to discover this advisory; it remains the authority for affected products and remediation. Discovered from the machine-readable feed https://access.redhat.com/hydra/rest/securitydata/cve.json; this link opens the Red Hat Linux advisory index instead of the raw feed document.
Red Hat Linux
Official vendor advisoryofficial
Official advisory article fetched and its advisory identity was verified before publication. identity-sha256=bfebf628f68a21fbf6a5275feda272510f02529b2ffbc506c4640e43e071b0e6
Red Hat Linux

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-110910NVD CVE.org MITRE

Free weekly CVE digest

Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Get CVE alerts See app features

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Low [CVE-2026-110910] Query parameter injection via unencoded empty array keys

Get an email when Red Hat Linux publishes the next one.

Summary

Mitigation checklist

More Red Hat Linux advisories

Monitor future Red Hat Linux CVEs from your phone.

Discussion(0)