Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
A denial of service vulnerability (CVE-2026-8723) exists in the qs library used in Red Hat Hardened Images RPMs. The flaw occurs when qs.stringify processes arrays containing null or undefined elements with specific configuration, causing a TypeError that crashes the application or returns a 500 error. This leads to denial of service for affected requests. Red Hat has released updated RPM packages including python3.14-3.14.6-1.1.hum1 to address this issue. No mitigation other than applying the update is currently recommended.
AI Analysis
Technical Summary
CVE-2026-8723 is a denial of service vulnerability in the qs library used by Red Hat Hardened Images RPMs. When qs.stringify is called with arrays containing null or undefined elements and configured with arrayFormat: 'comma' and encodeValuesOnly: true, a TypeError is triggered. This error causes the application to crash or return a 500 error, resulting in denial of service. Red Hat has issued updated packages including python3.14-3.14.6-1.1.hum1 to fix this flaw. No alternative mitigations meeting Red Hat's criteria are available. The vulnerability is tracked under CWE-476 (NULL Pointer Dereference) and related CWEs.
Potential Impact
The vulnerability causes a denial of service by crashing applications or returning server errors when processing certain malformed input arrays. This impacts availability but does not affect confidentiality or integrity. There are no known exploits in the wild. The flaw affects Red Hat Hardened Images RPMs including python3.14 packages on aarch64 and x86_64 architectures.
Mitigation Recommendations
Red Hat has released updated RPM packages (e.g., python3.14-3.14.6-1.1.hum1) that fix this vulnerability. Applying these updates is the recommended remediation. No other mitigations meeting Red Hat's criteria for ease of use and applicability are currently available. Users should refer to Red Hat's advisory and update their affected packages accordingly.
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Description
A denial of service vulnerability (CVE-2026-8723) exists in the qs library used in Red Hat Hardened Images RPMs. The flaw occurs when qs.stringify processes arrays containing null or undefined elements with specific configuration, causing a TypeError that crashes the application or returns a 500 error. This leads to denial of service for affected requests. Red Hat has released updated RPM packages including python3.14-3.14.6-1.1.hum1 to address this issue. No mitigation other than applying the update is currently recommended.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-8723 is a denial of service vulnerability in the qs library used by Red Hat Hardened Images RPMs. When qs.stringify is called with arrays containing null or undefined elements and configured with arrayFormat: 'comma' and encodeValuesOnly: true, a TypeError is triggered. This error causes the application to crash or return a 500 error, resulting in denial of service. Red Hat has issued updated packages including python3.14-3.14.6-1.1.hum1 to fix this flaw. No alternative mitigations meeting Red Hat's criteria are available. The vulnerability is tracked under CWE-476 (NULL Pointer Dereference) and related CWEs.
Potential Impact
The vulnerability causes a denial of service by crashing applications or returning server errors when processing certain malformed input arrays. This impacts availability but does not affect confidentiality or integrity. There are no known exploits in the wild. The flaw affects Red Hat Hardened Images RPMs including python3.14 packages on aarch64 and x86_64 architectures.
Mitigation Recommendations
Red Hat has released updated RPM packages (e.g., python3.14-3.14.6-1.1.hum1) that fix this vulnerability. Applying these updates is the recommended remediation. No other mitigations meeting Red Hat's criteria for ease of use and applicability are currently available. Users should refer to Red Hat's advisory and update their affected packages accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:33521
- Cve Count
- 1
- State
- PUBLISHED
Threat ID: 6a838c32bf8831d539b4acb6
Added to database: 08/17/2026, 22:33:22 UTC
Last enriched: 09/12/2026, 00:01:41 UTC
Last updated: 10/02/2026, 14:46:12 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.