Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Affects Red Hat Product Security Red HatSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited · CVSS 6.5 Medium.
Data as of 10/25/2026, 09:04:00 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 21% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Red Hat Product Security Red Hat | Affected
| Fixed in– |
AI-suggested
Red Hat has released updated RPM packages for Rust components that address CVE-2026-50185. Users of Red Hat Hardened Images should apply these updates by upgrading to the fixed package versions (1.97.1-1.1.hum1) available in the public-hummingbird repositories for aarch64 and x86_64 architectures. Refer to the official Red Hat advisory RHSA-2026:42923 for detailed update instructions. No additional mitigation steps are indicated by the vendor.
Description
This update includes the following RPMs: rust: * cargo-1.97.1-1.1.hum1 (aarch64, x86_64) * clippy-1.97.1-1.1.hum1 (aarch64, x86_64) * rust-1.97.1-1.1.hum1 (aarch64, x86_64) * rust-analyzer-1.97.1-1.1.hum1 (aarch64, x86_64) * rust-debugger-common-1.97.1-1.1.hum1 (noarch) * rust-doc-1.97.1-1.1.hum1 (aarch64, x86_64) * rust-gdb-1.97.1-1.1.hum1 (noarch) * rust-lldb-1.97.1-1.1.hum1 (noarch) * rust-src-1.97.1-1.1.hum1 (noarch) * rust-std-static-1.97.1-1.1.hum1 (aarch64, x86_64) * rust-std-static-aarch64-unknown-none-softfloat-1.97.1-1.1.hum1 (noarch) * rust-std-static-aarch64-unknown-uefi-1.97.1-1.1.hum1 (noarch) * rust-std-static-i686-pc-windows-gnu-1.97.1-1.1.hum1 (noarch) * rust-std-static-wasm32-unknown-unknown-1.97.1-1.1.hum1 (noarch) * rust-std-static-wasm32-wasip1-1.97.1-1.1.hum1 (noarch) * rust-std-static-x86_64-pc-windows-gnu-1.97.1-1.1.hum1 (noarch) * rust-std-static-x86_64-unknown-none-1.97.1-1.1.hum1 (noarch) * rust-std-static-x86_64-unknown-uefi-1.97.1-1.1.hum1 (noarch) * rustfmt-1.97.1-1.1.hum1 (aarch64, x86_64) * rust-1.97.1-1.1.hum1.src (src) Security Fix(es): rust: * CVE-2026-50185
Impact
The vulnerability (CWE-22) could potentially allow unauthorized access to files or directories outside the intended scope in Rust-related components within Red Hat Hardened Images. This may lead to information disclosure or other security issues depending on the context of use. However, no active exploitation has been reported, and the severity is assessed as medium by Red Hat.
Summary
This Red Hat security advisory (RHSA-2026:42923) addresses a security vulnerability identified as CVE-2026-50185 in the Rust packages included in Red Hat Hardened Images. The affected RPMs include cargo, clippy, rust, rust-analyzer, rustfmt, and several rust standard static libraries across aarch64 and x86_64 architectures. The vulnerability is classified under CWE-22 (Path Traversal), which could allow an attacker to access files or directories outside the intended scope. The advisory provides updated package versions (1.97.1-1.1.hum1) to remediate the issue. No CVSS score is provided, and there are no known exploits in the wild. The advisory directs users to update to the fixed package versions available in Red Hat's public repositories.
Weaknesses
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-681Incorrect Conversion between Numeric Types (opens in a new tab)
Base weaknessLikelihood of exploit: High
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
References
- access.redhat.com/errata/RHSA-2026:42923 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-50185 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- images.redhat.com (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-5223 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42923.json (opens in a new tab)