Red Hat issued a security advisory (RHSA-2026:38187) for Red Hat Hardened Images RPMs, including updated Rust-related packages. The advisory includes CVE-2026-59869, a denial of service vulnerability in the js-yaml parser caused by processing crafted YAML documents with merge keys that lead to excessive CPU usage. This vulnerability affects Red Hat products that use js-yaml to process untrusted YAML input. Red Hat rates this vulnerability as Important with a CVSS v3 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The advisory recommends restricting untrusted YAML processing and applying input validation. The update includes multiple rust-related RPMs at version 1.97.0-1.1.hum1 for aarch64 and x86_64 architectures. No explicit fixed version range is provided, but the advisory references updated packages to address the issue.

The vulnerability allows a remote attacker to cause a denial of service by supplying a specially crafted YAML document that triggers excessive CPU consumption during parsing. This can disrupt availability of affected systems without requiring authentication or complex attack vectors. The impact is limited to denial of service (resource exhaustion) and does not affect confidentiality or integrity.

Red Hat has released updated RPM packages for Red Hat Hardened Images that address the vulnerability. Users should apply these updates to remediate the issue. Additionally, to reduce exposure, restrict processing of untrusted YAML documents, implement robust input validation and sanitization for YAML data from untrusted sources, and consider limiting network access to services parsing YAML content to trusted clients via firewall rules. Patch status is confirmed as fixed in the updated RPMs referenced in the advisory.