Red Hat Update Infrastructure 5.2 Technology Preview container images contain multiple security vulnerabilities, including CVE-2026-4424 and eight additional CVEs. One example is CVE-2026-25679, where the Go standard library function net/url.Parse improperly validates host/authority components, accepting invalid URLs by ignoring garbage before an IP-literal. The Technology Preview status means these features are not fully supported or functionally complete and are unsuitable for production deployment. The advisory does not indicate any available patches or fixes for these vulnerabilities. Red Hat recommends consulting the Technology Preview release notes for instructions on usage. The vulnerabilities cover a range of CWEs such as CWE-125 (out-of-bounds read), CWE-88 (argument injection), CWE-190 (integer overflow), and others.

The vulnerabilities affect the Red Hat Update Infrastructure 5.2 Technology Preview container images, potentially allowing attackers to exploit improper input validation and parsing flaws. The CVSS score for CVE-2026-25679 is 7.5 (high) with an impact primarily on availability. However, the overall impact varies by vulnerability and context. Since these are Technology Preview features, they are not recommended for production use, limiting the practical impact. No known exploits in the wild have been reported. The lack of official fixes means the vulnerabilities remain unmitigated in this release.

No official patches or fixes are currently available for these vulnerabilities in the Technology Preview release. Red Hat advises that Technology Preview features are not suitable for production deployment. Users should consult the RHUI Technology Preview Release Notes at https://access.redhat.com/articles/7141172 for guidance on usage. If production use is required, users should avoid Technology Preview versions and use fully supported releases. Monitoring Red Hat advisories for future updates or fixes is recommended.