ByteOS Network

CVE Vulnerability Details :

CVE-2026-9165

PUBLISHED

More Info Official Page

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-06 Jul, 2026 | 08:46

Updated At-19 Jul, 2026 | 00:11

▼CVE Numbering Authority (CNA)

Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.

Affected Products

Vendor

Red Hat, Inc.

Product

Red Hat Advanced Cluster Security 4.9

Collection URL

https://catalog.redhat.com/software/containers/

Package Name

advanced-cluster-security/rhacs-main-rhel8

CPEs

cpe:/a:redhat:advanced_cluster_security:4.9::el8

Default Status

affected

Versions

Unaffected

From 1783357116 before * (rpm)

Vendor

Red Hat, Inc.

Product

Red Hat Advanced Cluster Security for Kubernetes 4.10

Collection URL

https://catalog.redhat.com/software/containers/

Package Name

advanced-cluster-security/rhacs-main-rhel8

CPEs

cpe:/a:redhat:advanced_cluster_security:4.10::el8

Default Status

affected

Versions

Unaffected

From 1783357140 before * (rpm)

Vendor

Red Hat, Inc.

Product

Red Hat Advanced Cluster Security for Kubernetes 4.11

Collection URL

https://catalog.redhat.com/software/containers/

Package Name

advanced-cluster-security/rhacs-main-rhel9

CPEs

cpe:/a:redhat:advanced_cluster_security:4.11::el9

Default Status

affected

Versions

Unaffected

From 1783352589 before * (rpm)

Problem Types

Type	CWE ID	Description
CWE	CWE-400	Uncontrolled Resource Consumption

Type: CWE

CWE ID: CWE-400

Description: Uncontrolled Resource Consumption

Metrics

Version	Base score	Base severity	Vector
3.1	7.7	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Version: 3.1

Base score: 7.7

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Metrics Other Info

Red Hat severity rating

value:

Important

namespace:

https://access.redhat.com/security/updates/classification/

Workarounds

There is no complete mitigation other than installing the update once available.

Credits

This issue was discovered by Moritz Clasmeier (Red Hat).

Timeline

Event	Date
Reported to Red Hat.	2026-05-21 00:00:00
Made public.	2026-07-06 08:38:30

Event: Reported to Red Hat.

Date: 2026-05-21 00:00:00

Event: Made public.

Date: 2026-07-06 08:38:30

References

Hyperlink	Resource
https://access.redhat.com/errata/RHSA-2026:36207	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36319	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36625	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-9165	vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2480505	issue-tracking x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2026:36207

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2026:36319

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2026:36625

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/security/cve/CVE-2026-9165

Resource:

vdb-entry

x_refsource_REDHAT

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2480505

Resource:

issue-tracking

x_refsource_REDHAT

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Unaffected

Unaffected

Unaffected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References