The vulnerability CVE-2026-2625 affects the rust-rpm-sequoia component in Red Hat Hardened Images. It arises from improper verification of cryptographic signatures during RPM package signature validation. A crafted RPM file can cause an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This causes a denial of service at the application level by disrupting RPM signature verification. Red Hat has issued a security update (rpm-sequoia-1.10.1.1-1.2.hum1) to fix this issue. The vulnerability has a CVSS v3.1 score of 4.0 (medium severity), with no confidentiality or integrity impact, only availability impact. No exploits are known to be active in the wild.

Successful exploitation results in an application-level denial of service by terminating the rpm process during signature verification. This prevents the system from processing RPM files for signature verification, potentially disrupting package management operations. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported.

Red Hat has released an official security update that addresses this vulnerability in rust-rpm-sequoia version 1.10.1.1-1.2.hum1. Applying this update to Red Hat Hardened Images RPMs will remediate the issue. Users should follow Red Hat's advisory instructions at https://access.redhat.com/security/cve/CVE-2026-2625 to apply the update. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.