The advisory covers a set of vulnerabilities including CVE-2026-44740, CVE-2026-47262, CVE-2026-53489, and CVE-2026-53492 affecting Red Hat Hardened Images RPMs, specifically the grype package version 0.115.0-0.1.hum1 for aarch64 and x86_64 architectures. CVE-2026-47262 is a denial of service vulnerability in containerd caused by uncontrolled resource consumption from maliciously crafted container images. Red Hat products are not affected by this vulnerability because they use CRI-O instead of containerd as the container runtime, and the vulnerable code path is not executed. The advisory includes updated RPMs to address bugs and enhancements but does not explicitly state fixes for the CVEs. No exploits are known in the wild. The advisory references multiple CWEs related to resource allocation and security controls.

The primary impact is a potential denial of service condition caused by resource exhaustion in container runtimes when processing malicious images. However, Red Hat products are not vulnerable to this specific containerd flaw due to their use of CRI-O. The vulnerabilities may affect components included in Red Hat Hardened Images, but no active exploitation is reported. The overall impact is disruption of container runtime services if exploited, but this is mitigated in Red Hat environments by architectural choices.

Red Hat states that no mitigation is needed for their products regarding the containerd-related vulnerability because the vulnerable code path is not executed in their container runtime implementation. Users should apply the updated RPM packages (grype-0.115.0-0.1.hum1) provided in the advisory to benefit from bug fixes and enhancements. For other vulnerabilities mentioned, follow Red Hat's standard update procedures as detailed in the advisory. Monitor Red Hat's official channels for any further updates or patches.