The Red Hat RHEL-8 based Middleware Containers container images were updated to fix several security issues documented in multiple Red Hat Security Advisories (RHSA-2026:11077, RHSA-2026:7667, RHSA-2026:8534, RHSA-2026:9745). The vulnerabilities addressed include CVE-2025-10158 (rsync out-of-bounds array access), CVE-2025-9820 (gnutls stack-based buffer overflow), CVE-2025-14831 (gnutls denial of service), CVE-2026-3497 (openssh GSSAPI information disclosure or denial of service), CVE-2026-27135 (nghttp2 denial of service), CVE-2026-4424 (libarchive information disclosure), CVE-2026-4519 (python command-line option injection), CVE-2026-5121 (libarchive arbitrary code execution), CVE-2026-6100 (python use-after-free leading to arbitrary code execution or information disclosure), and CVE-2026-4786 (python command injection). These fixes are backported into updated container images. Users of these images should upgrade and rebuild dependent containers to mitigate these issues. The vendor advisory confirms the availability of updated images and patches.

The vulnerabilities collectively allow for potential out-of-bounds memory access, buffer overflows, denial of service conditions, information disclosure, command injection, and arbitrary code execution within the affected container images. This can lead to unauthorized access, service disruption, or execution of malicious code within environments running these containers. The impact is rated high due to the range of critical issues fixed.

Red Hat has released updated RHEL-8 based Middleware Containers container images containing backported patches that address these vulnerabilities. Users are strongly advised to upgrade to these updated images and rebuild all container images that depend on them. No alternative mitigations are specified. Patch status is confirmed by the vendor advisory.