This Red Hat security advisory (RHSA-2026:46989) addresses two vulnerabilities in the tempo3.0 RPMs included in Red Hat Hardened Images. The primary vulnerability, CVE-2026-48586, is an improper handling of highly compressed data in Apache Thrift, which can be exploited remotely without authentication to cause a denial of service via resource exhaustion (CPU and memory). This vulnerability is categorized under CWE-409 (Improper Handling of Highly Compressed Data) and related CWEs CWE-190 and CWE-835. The advisory provides updated RPMs tempo3.0-3.0.2-0.2.hum1 for aarch64 and x86_64 architectures. The vendor advisory does not explicitly state a fixed version beyond this update, nor does it provide a direct patch link. No known exploits in the wild have been reported. Red Hat scores this vulnerability as high severity due to its impact on availability. The advisory recommends applying the updated RPMs as the remediation.

The vulnerabilities allow remote, unauthenticated attackers to cause denial of service conditions by sending specially crafted highly compressed data to affected Apache Thrift components in Red Hat Hardened Images. This leads to excessive CPU and memory consumption, potentially causing system crashes or unavailability of services relying on these components. No confidentiality or integrity impacts are reported. No known active exploitation has been observed.

Apply the updated Red Hat Hardened Images RPMs containing tempo3.0 version 3.0.2-0.2.hum1 as provided in the advisory RHSA-2026:46989. This update addresses CVE-2026-48586 and CVE-2026-55969. Since no cloud service is involved, manual update of the affected RPMs is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated. Patch status beyond this update is not explicitly confirmed; users should monitor Red Hat advisories for further updates.