This advisory from Red Hat Product Security addresses security vulnerabilities in the gzip package included in Red Hat Hardened Images RPMs. The affected package version is gzip 1.14-2.2.hum1 for aarch64 and x86_64 architectures. The vulnerabilities fixed are CVE-2026-41911 and CVE-2026-41991, with the latter associated with CWE-59 (Improper Link Resolution Before File Access). The advisory does not provide a CVSS score or detailed technical exploitation information. The update is available via Red Hat's public repositories and is intended to mitigate these security issues.

The vulnerabilities affect gzip RPMs used in Red Hat Hardened Images on aarch64 and x86_64 platforms. CWE-59 suggests a potential issue with improper link resolution before file access, which could lead to security risks such as unauthorized file manipulation or privilege escalation if exploited. However, no known exploits in the wild have been reported. The severity is assessed as medium by Red Hat.

A security update is available that includes the fixed gzip package version 1.14-2.2.hum1 for the affected architectures. Users of Red Hat Hardened Images should apply this update promptly to remediate the vulnerabilities. Refer to Red Hat's official advisory RHSA-2026:33771 and the Red Hat images repository for update instructions. No additional mitigation steps are indicated by the vendor.