Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
This update includes the following RPMs: erlang27: * erlang27-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-asn1-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-common_test-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-compiler-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-crypto-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-debugger-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-dialyzer-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-diameter-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-edoc-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-eldap-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-erl_interface-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-erts-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-et-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-eunit-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-examples-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-ftp-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-gdb-tools-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-inets-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-jinterface-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-kernel-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-megaco-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-mnesia-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-observer-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-odbc-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-os_mon-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-parsetools-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-public_key-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-reltool-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-runtime_tools-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-sasl-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-snmp-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-ssh-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-ssl-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-stdlib-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-syntax_tools-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-tftp-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-tools-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-wx-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-xmerl-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-27.3.4.14-1.hum1.src (src)
AI Analysis
Technical Summary
CVE-2026-53422 is an information disclosure vulnerability in Erlang OTP's SSH component, specifically in the SFTP daemon's REALPATH handler. An authenticated SFTP user can exploit differences in server responses to determine whether files or directories exist outside their permitted root directory. This flaw is categorized under CWE-204 (Observable Response Discrepancy). The vulnerability does not grant access to file contents or modification capabilities but can reveal sensitive filesystem structure information. Red Hat has issued a security advisory (RHSA-2026:35998) providing updated Erlang 27 RPM packages for Red Hat Hardened Images to mitigate this issue.
Potential Impact
The vulnerability allows authenticated SFTP users to enumerate files and directories outside their authorized root, potentially revealing sensitive information about the server's filesystem structure. There is no direct exposure of file contents or write access. The information gained could be leveraged to facilitate further attacks. The impact is limited to confidentiality with no integrity or availability effects.
Mitigation Recommendations
Red Hat has released updated Erlang 27 RPM packages for Red Hat Hardened Images that address this vulnerability. Users should apply these official updates as provided in Red Hat Advisory RHSA-2026:35998. No additional mitigations are specified or required beyond applying the vendor's fix.
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Description
This update includes the following RPMs: erlang27: * erlang27-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-asn1-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-common_test-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-compiler-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-crypto-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-debugger-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-dialyzer-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-diameter-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-edoc-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-eldap-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-erl_interface-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-erts-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-et-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-eunit-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-examples-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-ftp-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-gdb-tools-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-inets-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-jinterface-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-kernel-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-megaco-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-mnesia-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-observer-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-odbc-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-os_mon-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-parsetools-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-public_key-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-reltool-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-runtime_tools-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-sasl-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-snmp-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-ssh-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-ssl-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-stdlib-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-syntax_tools-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-tftp-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-tools-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-wx-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-xmerl-27.3.4.14-1.hum1 (aarch64, x86_64) * erlang27-27.3.4.14-1.hum1.src (src)
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-53422 is an information disclosure vulnerability in Erlang OTP's SSH component, specifically in the SFTP daemon's REALPATH handler. An authenticated SFTP user can exploit differences in server responses to determine whether files or directories exist outside their permitted root directory. This flaw is categorized under CWE-204 (Observable Response Discrepancy). The vulnerability does not grant access to file contents or modification capabilities but can reveal sensitive filesystem structure information. Red Hat has issued a security advisory (RHSA-2026:35998) providing updated Erlang 27 RPM packages for Red Hat Hardened Images to mitigate this issue.
Potential Impact
The vulnerability allows authenticated SFTP users to enumerate files and directories outside their authorized root, potentially revealing sensitive information about the server's filesystem structure. There is no direct exposure of file contents or write access. The information gained could be leveraged to facilitate further attacks. The impact is limited to confidentiality with no integrity or availability effects.
Mitigation Recommendations
Red Hat has released updated Erlang 27 RPM packages for Red Hat Hardened Images that address this vulnerability. Users should apply these official updates as provided in Red Hat Advisory RHSA-2026:35998. No additional mitigations are specified or required beyond applying the vendor's fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:35998
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a50ba8668715ace435817e2
Added to database: 07/10/2026, 09:25:26 UTC
Last enriched: 08/16/2026, 17:51:12 UTC
Last updated: 08/23/2026, 22:52:11 UTC
Views: 31
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.