The advisory covers security fixes for Red Hat Hardened Images RPMs, specifically tempo2.10 version 2.10.7-0.2.hum1. The primary vulnerability, CVE-2026-48586, is an improper handling of highly compressed data in Apache Thrift that can cause denial of service via resource exhaustion (CPU and memory). This flaw allows unauthenticated remote attackers to send specially crafted compressed data that the affected component fails to manage properly, resulting in system unavailability. The advisory also addresses CVE-2026-55969, though details on this second CVE are not provided. Red Hat provides updated RPMs to mitigate these issues. The CVSS score for CVE-2026-48586 is approximately 7.5 (high severity) per Red Hat's assessment. No known active exploitation is reported. The advisory does not explicitly state if the update fully fixes the vulnerabilities but provides updated packages for deployment.

The primary impact is a denial of service condition caused by resource exhaustion (CPU and memory) when processing specially crafted highly compressed data in Apache Thrift. This can lead to degraded system performance or crash, affecting availability of services using the vulnerable tempo2.10 component in Red Hat Hardened Images. No confidentiality or integrity impacts are reported. No known exploits in the wild have been observed.

Red Hat has released updated RPM packages (tempo2.10-2.10.7-0.2.hum1) for affected architectures (aarch64, x86_64). Applying these updates is the recommended remediation. No additional mitigations or workarounds are specified in the advisory. Patch status beyond the availability of updated RPMs is not explicitly confirmed; users should apply the update as provided by Red Hat. Monitor Red Hat's official advisories for further updates or fixes.