Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

This Red Hat security advisory announces an update to Red Hat Hardened Images RPMs, specifically the golang1.26 package set, to address several vulnerabilities identified by CVE-2026-94440, CVE-2026-97030, and CVE-2026-111943. The update includes multiple RPMs for various architectures (aarch64, s390x, x86_64, and noarch). The advisory does not specify the exact nature of the vulnerabilities beyond referencing CWE identifiers (CWE-770, CWE-79, CWE-295) nor does it provide CVSS scores. The advisory directs users to Red Hat's image repository for applying the update. No known exploits in the wild have been reported.

The vulnerabilities addressed are rated as high severity by Red Hat. The referenced CWEs suggest issues related to improper resource management (CWE-770), cross-site scripting (CWE-79), and improper certificate validation (CWE-295). These could potentially allow attackers to exploit the affected golang1.26 RPMs if unpatched. However, no active exploitation has been reported, and the impact is limited to systems using the affected Red Hat Hardened Images RPMs.

A fix is available through updated Red Hat Hardened Images RPMs, specifically golang1.26 version 1.26.10-0.1.hum1 and related packages. Users should apply these updates from the official Red Hat repositories as detailed in the advisory at https://images.redhat.com/. No additional mitigation steps are specified or required beyond applying the update.