This Red Hat security advisory (RHSA-2026:15862) announces an update to the Red Hat Hardened Images RPMs, including the trivy package version 0.69.3-1.2.hum1 for aarch64 and x86_64 platforms. It addresses two CVEs: CVE-2026-44432 and CVE-2026-45287, linked to CWE-409 (improper locking) and CWE-772 (missing release of resource after effective lifetime). The advisory does not provide detailed technical descriptions or CVSS scores but indicates a high severity classification. No known exploits have been reported. The update is intended as a bug fix and enhancement, with instructions to apply the update available on Red Hat's image repository site. No affected versions are explicitly listed, and no cloud service remediation applies.

The vulnerabilities addressed relate to resource management issues (CWE-409 and CWE-772) that could potentially lead to improper locking or resource leaks. The advisory classifies the severity as high but does not provide explicit impact details or exploitation scenarios. No known exploits in the wild have been reported, indicating limited or no active exploitation at this time.

An official update is available from Red Hat that includes the fixed trivy RPM packages (version 0.69.3-1.2.hum1). Users of Red Hat Hardened Images should apply this update following Red Hat's published guidance at https://images.redhat.com/. No additional mitigation steps are indicated or required beyond applying the official update.