Red Hat Security Advisory: Satellite 6.18.9 Async Update

Red Hat Satellite 6.18 versions before 6.18.9 are affected by multiple security vulnerabilities across several components. Notable issues include HTTP request smuggling via WebSocket upgrade (CVE-2026-69243), denial of service via malformed HTTP responses (CVE-2026-69244), information disclosure due to retained HTTP/1.1 trailers (CVE-2026-10051), arbitrary code execution through untrusted input and argument injection (CVE-2026-34993, CVE-2026-11332, CVE-2026-54512, CVE-2026-16493), and authentication bypass due to empty key in HMAC verification (CVE-2026-45363). The update to Satellite 6.18.9 includes fixes for these vulnerabilities and resolves several upgrade and functionality bugs. The vendor advisory confirms the availability of this update as the official fix.

The vulnerabilities allow attackers to perform HTTP request smuggling, cause denial of service conditions, disclose sensitive information, execute arbitrary code, and bypass authentication mechanisms. These issues could compromise the confidentiality, integrity, and availability of systems managed by Red Hat Satellite 6.18 prior to 6.18.9. The affected components are critical to the operation and security of the Satellite infrastructure.

Red Hat has released version 6.18.9 of Satellite which addresses all listed vulnerabilities and related bugs. Users should apply this update promptly after ensuring all previously released errata relevant to their system have been applied. The vendor advisory provides detailed instructions for applying the update. No additional mitigation steps are indicated beyond applying the official fix.