This Red Hat security advisory (RHSA-2026:42923) addresses a security vulnerability identified as CVE-2026-50185 in the Rust packages included in Red Hat Hardened Images. The affected RPMs include cargo, clippy, rust, rust-analyzer, rustfmt, and several rust standard static libraries across aarch64 and x86_64 architectures. The vulnerability is classified under CWE-22 (Path Traversal), which could allow an attacker to access files or directories outside the intended scope. The advisory provides updated package versions (1.97.1-1.1.hum1) to remediate the issue. No CVSS score is provided, and there are no known exploits in the wild. The advisory directs users to update to the fixed package versions available in Red Hat's public repositories.

The vulnerability (CWE-22) could potentially allow unauthorized access to files or directories outside the intended scope in Rust-related components within Red Hat Hardened Images. This may lead to information disclosure or other security issues depending on the context of use. However, no active exploitation has been reported, and the severity is assessed as medium by Red Hat.

Red Hat has released updated RPM packages for Rust components that address CVE-2026-50185. Users of Red Hat Hardened Images should apply these updates by upgrading to the fixed package versions (1.97.1-1.1.hum1) available in the public-hummingbird repositories for aarch64 and x86_64 architectures. Refer to the official Red Hat advisory RHSA-2026:42923 for detailed update instructions. No additional mitigation steps are indicated by the vendor.