This Red Hat security advisory addresses multiple vulnerabilities in the Red Hat Hardened Images RPMs, including CVE-2026-13573. The vulnerabilities relate to resource allocation and memory management flaws (CWE-120, CWE-805, CWE-409, CWE-770) in components such as the llvm21 package set and brace-expansion libraries. Specifically, CVE-2026-45149 describes a denial of service caused by excessive memory allocation when expanding large numeric ranges. The advisory provides updated RPM packages (version 21.1.8-6.hum1) for aarch64 and x86_64 architectures that fix these issues. Red Hat Hardened Images users should apply these updates to mitigate the vulnerabilities. The vendor advisory confirms no known exploits in the wild and no cloud service impact. The update is available and should be applied to affected systems.

The vulnerabilities can lead to denial of service conditions by causing excessive memory allocation and resource exhaustion, potentially crashing applications or impacting system availability. There is no indication of confidentiality or integrity impact. The issues affect systems using the vulnerable RPM packages in Red Hat Hardened Images, specifically those using llvm21 components. No active exploitation has been reported. The impact is primarily on system availability.

A fix is available through the updated Red Hat Hardened Images RPM packages version 21.1.8-6.hum1 for the llvm21 package set and related components. Users should apply these updates as provided by Red Hat. No alternative mitigations are noted or recommended by the vendor. Red Hat Product Security advises applying the official update to remediate the vulnerabilities.