This Red Hat security advisory (RHSA-2026:26989) covers a set of vulnerabilities in the Red Hat Hardened Images RPMs, including CVE-2026-14683 and related CVEs. The primary issue in CVE-2026-14683 involves a flaw in the HdrHistogram library's decodeFromCompressedByteBuffer function, where manipulation of the lengthOfCompressedContents argument by a local attacker can trigger uncontrolled memory allocation. This leads to a denial of service condition by exhausting system resources. The vulnerabilities affect netavark version 2.0.0-1.hum1 on aarch64 and x86_64 architectures. Red Hat has issued updated RPMs to address these flaws. The advisory notes that exploitation requires local access and does not allow arbitrary code execution or data compromise. The CVSS score assigned by Red Hat is 3.3 (medium severity), reflecting low impact limited to availability.

The vulnerabilities allow a local attacker to cause denial of service through resource exhaustion by triggering uncontrolled memory allocation in the affected function. There is no impact on confidentiality or integrity, and no remote exploitation is indicated. The affected system may become unavailable due to resource consumption, but no arbitrary code execution or data compromise occurs.

Red Hat has released updated RPM packages (netavark-2.0.0-1.hum1) that fix these vulnerabilities. Users of Red Hat Hardened Images should apply this update promptly to mitigate the risk. No additional mitigations are specified or required beyond applying the official update. There are no known exploits in the wild at this time.