The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check (CVE-2026-39831)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs (CVE-2026-46597)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)
* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)
* golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This Red Hat security advisory addresses multiple vulnerabilities and bug fixes in the Linux kernel packages for Red Hat Enterprise Linux 8 and 9. It includes a denial of service vulnerability in the qla2xxx SCSI driver (CVE-2025-68745) and several other security issues affecting Bluetooth, DRM, SCTP, Wi-Fi, and other kernel subsystems. The update is rated as important by Red Hat and requires a system reboot to apply. The advisory also contains non-security bug fixes and enhancements.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.
Security Fix(es):
* gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header (CVE-2026-85150)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified and addressed in Apache Tomcat as packaged in Red Hat JBoss Web Server and Red Hat Enterprise Linux. These include improper input validation, authentication bypasses, HTTP/2 header validation issues, information disclosure, improper authorization, case sensitivity handling flaws, and security constraint bypasses. The update to Red Hat JBoss Web Server 6.0.3 includes fixes for these issues. The vulnerabilities affect various versions of Tomcat and related components within Red Hat products. A security update is available to remediate these issues.
This Red Hat security advisory addresses multiple vulnerabilities and bug fixes in the Linux kernel, including three specific security fixes: a signed comparison issue in io_uring polling (CVE-2026-52933), a heap overflow in USB serial driver io_ti (CVE-2026-53196), and a double-free in SMB client query directory replay (CVE-2026-64387). The advisory also includes various bug fixes and enhancements. A patch is available to remediate these issues. The vulnerabilities are rated as high severity, but no known exploits are reported in the wild at this time.
A heap out-of-bounds read vulnerability exists in the cupsUTF32ToUTF8() function of the CUPS printing system due to missing source-length bounds during SNMP supply-description parsing. This vulnerability is tracked as CVE-2026-87875 and affects multiple versions of CUPS included in Red Hat Hardened Images. A security update has been issued by Red Hat to address this issue.
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
* openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.44. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:57401
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/
A vulnerability in the GridFS component of the MongoDB Python Driver (pymongo) allows improper neutralization of special elements in data query logic. This flaw can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may access stored file content beyond the intended target, delete all GridFS file chunks in the affected bucket, or cause unintended file renaming.
A vulnerability in GNU tar (CVE-2026-5704) allows specially crafted archive files to cause tar to improperly overwrite files. This can enable attackers to inject hidden files with attacker-controlled content, bypassing pre-extraction inspection mechanisms. The issue affects multiple versions of tar across various Linux distributions including Ubuntu and openSUSE. Fixes have been released for supported Ubuntu LTS releases and openSUSE Tumbleweed. Users are advised to update to the fixed package versions to mitigate the risk.
GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.
When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.
When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.
This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs that includes an update to the Trivy package addressing vulnerabilities identified as CVE-2026-71556 and CVE-2026-15789. These vulnerabilities relate to security weaknesses classified under CWE-22 (Path Traversal) and CWE-59 (Link Following). The update includes version 0.74.0-0.2.hum1 of Trivy for aarch64 and x86_64 architectures. No explicit patch details are provided beyond the availability of this update.
Red Hat has issued an important security update for Red Hat JBoss Enterprise Application Platform 7.4 addressing multiple vulnerabilities. These include unauthenticated queue creation and session hijacking in Apache Artemis, as well as privilege escalation and unexpected property modification issues in jackson-databind. The vulnerabilities affect Red Hat JBoss EAP 7.4 versions for RHEL 7, 8, and 9. The update mitigates these issues to improve platform security.
Multiple security vulnerabilities have been identified in Vim (Vi IMproved) editor affecting Red Hat Enterprise Linux 10 and its variants. These include information disclosure, denial of service, and arbitrary code execution issues triggered by crafted Unicode characters, spell files, vimball files, netrw menu entries, and insecure shell command handling. Red Hat has issued an important security advisory with updates to address these vulnerabilities.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.16.70. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:62548
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/
Security Fix(es):
* unbound: Unbound Cache poisoning (CVE-2025-5994)
* sqlite: Integer Truncation in SQLite (CVE-2025-6965)
* podman: Podman kube play command may overwrite host files (CVE-2025-9566)
* libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)
* libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)
* kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)
* bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)
* samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
* bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)
* dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)
* bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
* bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)
* dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
* openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230)
* samba: vfs_worm does not block directory modification (CVE-2026-2340)
* gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833)
* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)
* systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
Multiple vulnerabilities have been identified in osbuild-composer, a Red Hat service used for building customized OS artifacts, including certificate validation bypass, denial of service, and cross-site scripting issues in Go language components. These affect Red Hat Enterprise Linux 10 and related products. A patch is available to address these security flaws.
Multiple security vulnerabilities have been identified and fixed in the Linux kernel packages distributed by Red Hat. These include issues such as use-after-free, double-free, TOCTOU race conditions, and improper handling of network protocols and cryptographic requests. The update addresses a broad range of kernel subsystems and architectures. A patch is available to remediate these vulnerabilities.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including an update to the 'hugo' package version 0.166.0-0.1.hum1 for aarch64 and x86_64 architectures. This update addresses multiple vulnerabilities identified by several CVEs. The advisory provides updated RPMs to fix bugs and enhance security. No explicit CVSS score is provided, but the severity is marked as high.
Red Hat has issued a critical security advisory updating container images for HawtIO 4.4.1 used in the Red Hat build of Apache Camel 4. These updated images include backported patches addressing security issues, bugs, and enhancements. Users are advised to upgrade to these updated container images and rebuild any dependent images. The advisory references two CVEs (CVE-2026-77968 and CVE-2026-78234) and is linked to Red Hat security advisories RHSA-2026:66120 and RHSA-2026:42952. No specific affected software versions are detailed in the advisory. No known exploits in the wild have been reported. The vendor provides updated container images via the Red Hat Container Registry and recommends updating Dockerfiles accordingly.