Red Hat Security Advisory: Satellite 6.16.13 Async Update

Red Hat Satellite 6.16.13 for RHEL 8 and 9 fixes several security vulnerabilities including arbitrary code execution via PolymorphicTypeValidator bypass in jackson-databind (CVE-2026-54512), authentication bypass due to empty key in HMAC verification in ruby-jwt (CVE-2026-45363), denial of service and HTTP request smuggling in python-aiohttp (CVE-2026-69244, CVE-2026-69243), arbitrary code execution via untrusted input to CookieJar.load() in python-aiohttp (CVE-2026-34993), information disclosure due to retained HTTP/1.1 trailers in Eclipse Jetty (CVE-2026-10051), and denial of service via incomplete fix in async JSON parser in jackson-core (CVE-2026-68494). These vulnerabilities affect Red Hat Satellite 6.16 versions from 6.16.0 up to but not including 6.16.13. The update also fixes a bug related to content view filtering using the openssl package.

The vulnerabilities fixed in this update could allow attackers to execute arbitrary code, bypass authentication mechanisms, cause denial of service conditions, perform HTTP request smuggling attacks, and disclose sensitive information. These impacts affect the security and stability of Red Hat Satellite deployments running affected versions, potentially compromising system integrity and confidentiality.

A security update to Red Hat Satellite 6.16.13 is available that addresses these vulnerabilities. Users should apply this official update to remediate the issues. Before applying this update, ensure all previously released errata relevant to your system have been applied. Refer to the Red Hat advisory RHSA-2026:63327 and official documentation for detailed update instructions.