This Red Hat security advisory (RHSA-2026:2563) covers a security update for Red Hat Update Infrastructure 5 container images, which are updated to the latest RHUI RPM packages and ubi9 or ubi9-init base images. The advisory addresses 21 CVEs including CVE-2025-9086 and CVE-2025-11187. CVE-2025-11187 is a moderate severity OpenSSL vulnerability affecting versions 3.4, 3.5, and 3.6, caused by improper validation of PBMAC1 parameters in PKCS#12 MAC verification, leading to stack buffer overflow or NULL pointer dereference. Exploitation requires processing a malicious PKCS#12 file, which is uncommon. The advisory recommends deploying updated container images via the rhui-installer utility but does not explicitly confirm a patch or fix status for all CVEs. No known exploits in the wild have been reported. The update is considered important and rated high severity overall.

The vulnerabilities addressed include potential denial of service and arbitrary code execution risks, notably from CVE-2025-11187 in OpenSSL when processing malicious PKCS#12 files. The impact is rated high severity by Red Hat, indicating significant risk if exploited. However, exploitation requires local processing of crafted files, which are typically trusted, reducing likelihood. No known active exploits have been reported.

The advisory recommends deploying the updated Red Hat Update Infrastructure 5 container images using the rhui-installer utility as per official documentation. For the OpenSSL vulnerability CVE-2025-11187, it is advised to avoid processing untrusted PKCS#12 files, as these files are typically trusted and used for private keys. Patch status is not explicitly confirmed in the advisory; therefore, users should follow Red Hat's official documentation and errata for updates and deployment instructions.