Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

This Red Hat security advisory covers a bug fix and enhancement update for Red Hat Hardened Images RPMs, including spire1.15 packages version 1.15.2-0.4.hum1 for aarch64 and x86_64. Among the addressed vulnerabilities is CVE-2026-72816, an IP spoofing vulnerability in the go-chi/chi RealIP middleware. The RealIP middleware improperly trusts client-supplied HTTP headers (True-Client-IP, X-Real-IP, X-Forwarded-For) without validating the upstream proxy, allowing remote unauthenticated attackers to spoof IP addresses. This can lead to bypassing IP-restricted endpoints, subverting rate-limiting controls, and polluting audit logs. The impact on confidentiality and integrity is low. The advisory recommends not using the RealIP middleware directly with untrusted networks and instead sanitizing forwarding headers at an upstream proxy. The update includes fixes for multiple CVEs but does not explicitly detail fixes for CVE-2026-72815 in the provided content.

The IP spoofing vulnerability (CVE-2026-72816) allows remote attackers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and poison audit logs by supplying arbitrary IP addresses in HTTP headers. This poses a low impact on confidentiality and integrity. No known exploits are reported in the wild. The overall impact of the update is to mitigate these risks by updating the affected RPMs.

A fix is available via the updated Red Hat Hardened Images RPMs (spire1.15 version 1.15.2-0.4.hum1). For the IP spoofing vulnerability in the RealIP middleware, Red Hat advises not to use this middleware when receiving traffic directly from untrusted networks or unverified proxies. Instead, client-supplied forwarding headers should be stripped or sanitized at an upstream edge or reverse proxy (e.g., NGINX or HAProxy) before requests reach the application. Refer to the Red Hat advisory and https://images.redhat.com/ for update application instructions.