This Red Hat security advisory (RHSA-2026:25138) announces a bug fix and enhancement update for Red Hat Hardened Images RPMs, including cosign version 3.1.1-0.1.hum1 for aarch64 and x86_64. The advisory addresses two CVEs: CVE-2026-41889 and CVE-2026-45287, which correspond to vulnerabilities related to CWE-89 (SQL Injection) and CWE-772 (Missing Release of Resource after Effective Lifetime). The advisory does not provide detailed technical descriptions or exploitation scenarios. There are no known exploits in the wild. The update is available and users should apply it as per Red Hat's instructions.

The vulnerabilities involve security weaknesses classified as CWE-89 (SQL Injection) and CWE-772 (resource management issues), which could potentially allow unauthorized actions or resource exhaustion if exploited. However, the advisory does not specify the exact impact or exploitation details. No known exploits have been reported in the wild, indicating limited or no active exploitation at this time.

An official update is available for Red Hat Hardened Images RPMs, including cosign version 3.1.1-0.1.hum1. Users should apply this update following Red Hat's guidance at https://images.redhat.com/. No additional mitigation steps are indicated or required beyond applying the provided update.