This security advisory from Red Hat addresses multiple vulnerabilities affecting Red Hat Update Infrastructure 5.2 container images, which are based on the latest RHUI RPM packages and ubi9 or ubi9-init base images. Among the referenced CVEs is CVE-2026-28390, a moderate severity denial-of-service vulnerability in OpenSSL. The flaw occurs during processing of Cryptographic Message Syntax (CMS) EnvelopedData messages with RSA-OAEP encryption, where an optional parameter is accessed without verification, leading to a NULL pointer dereference and potential application crash. The vulnerability is limited to scenarios involving CMS/S/MIME processing and does not affect all OpenSSL consumers. The advisory does not confirm the availability of a patch or fix for these vulnerabilities but recommends deploying updated container images using the rhui-installer utility and following official documentation. No evidence of memory corruption or code execution is reported, and no known exploits are in the wild.

The primary impact is a denial-of-service condition caused by a NULL pointer dereference in OpenSSL CMS EnvelopedData processing, which can crash applications that process attacker-controlled CMS data with RSA-OAEP encryption. This affects availability but does not compromise confidentiality or integrity. The vulnerability is considered moderate by Red Hat due to its limited exposure and the niche functionality required to trigger it. No evidence of code execution or memory corruption has been observed. No known active exploitation has been reported.

No official fix or patch is explicitly stated in the advisory. Mitigation involves configuring applications that process CMS EnvelopedData messages to accept input only from trusted sources. Additionally, restricting network access to services that handle untrusted CMS data can reduce exposure to this denial-of-service vulnerability. Deploy the updated container images using the rhui-installer utility as recommended by Red Hat and follow the official product documentation for deployment guidance. Monitor Red Hat advisories for updates regarding patches or fixes.