Red Hat has released a critical security update for Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15. This update addresses multiple security vulnerabilities identified by various CVEs including CVE-2024-38827 and numerous others from 2026. The advisory recommends upgrading to the latest version of Openshift Jenkins 4.15 to mitigate these issues.
This update for librsvg fixes the following issues:
Update to version 2.60.2:
- CVE-2024-12224: Fixed idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243867).
- CVE-2024-43806: Fixed memory explosion in rustix (bsc#1229950).
Red Hat has issued a security update for PHP 8.3 addressing three vulnerabilities: a denial of service via unbounded recursion in the SOAP parser (CVE-2026-91765), an out-of-memory bailout during request parsing that can lead to memory corruption and remote code execution (CVE-2026-109618), and a use-after-free vulnerability due to stale request state retention in fatal error handling (CVE-2026-109619). These issues affect Red Hat Enterprise Linux 9 across multiple architectures. The update is rated as Important by Red Hat Product Security.
A local privilege escalation vulnerability exists in the Multi Router Traffic Grapher (MRTG) daemon when started as root and subsequently dropping privileges. The flaw involves symlink-following chown operations on the PID file path, allowing a local low-privileged attacker to escalate privileges. This issue is tracked as CVE-2026-72694 and affects multiple MRTG versions. A security update addressing this vulnerability is available from Red Hat.
A security vulnerability in the Linux kernel's IPv4 implementation was identified and fixed by Red Hat. The issue involves improper validation of the checksum_start parameter before completing the checksum calculation. This vulnerability is tracked as CVE-2026-99999 and affects Red Hat Enterprise Linux 9.4 versions. Red Hat has released a security update to address this issue and recommends applying the update and rebooting the system to ensure the fix takes effect.
Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings.
Red Hat has released a security advisory for Red Hat Hardened Images RPMs, including multiple PHP packages version 8.5.11-2.hum1 for aarch64 and x86_64 architectures. This update addresses several vulnerabilities identified by multiple CVEs, including CVE-2025-1218. The advisory marks the severity as high but does not provide detailed technical descriptions or CVSS scores. Updated RPM packages are available to fix bugs and enhance security in these PHP packages.
This golang security update addresses multiple vulnerabilities including a high-severity HTTP/1 CONNECT request handling flaw (CVE-2026-56866) where a non-empty request body can cause connection desynchronization and cross-user response poisoning in reverse proxies. Additional issues fixed include HTTP/2 response smuggling due to lax header validation (CVE-2026-78660) and multipart form parsing that can bypass memory limits (CVE-2026-94440).
Multiple security vulnerabilities have been identified in OpenEXR, an open-source high-dynamic-range image file format library used for high-quality image processing and storage. These vulnerabilities include memory corruption, denial of service, out-of-bounds write, and information disclosure issues triggered by processing specially crafted EXR image files. Red Hat has issued an important security advisory for OpenEXR in Red Hat Enterprise Linux 9, providing updated packages to address these issues. The vulnerabilities affect various architectures supported by Red Hat Enterprise Linux 9 and related products. No CVSS scores are provided, but the overall severity is rated as important by Red Hat. Users are advised to apply the available updates as detailed in the Red Hat advisory.
Red Hat has released a critical security advisory for Red Hat Ansible Automation Platform 2.7 Container Release addressing multiple security vulnerabilities. The update fixes several CVEs affecting the platform, which is used for enterprise IT automation. Users are advised to apply the update after ensuring all previous errata are applied. No specific affected versions are detailed in the advisory.
A local information disclosure vulnerability in cockpit-machines allows a local attacker to obtain a sensitive Red Hat Subscription Management offline token. The token is exposed via command-line arguments to a helper script during token validation. Exploitation requires local access and the ability to inspect process metadata on systems without restrictive /proc visibility settings. The vulnerability compromises confidentiality but does not affect integrity or availability.
A denial of service (DoS) vulnerability exists in the HTTP cookie parsing functionality of the python-tornado library, identified as CVE-2024-52804 (also referenced as CVE-2024-14029). This affects multiple versions of the Tornado Python web framework and asynchronous networking library. Red Hat Enterprise Linux 9 updates address this issue with security advisories and patches. The vulnerability has a CVSS score of 7.5, indicating a medium severity impact.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.52. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:83478
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/
Security Fix(es):
* kernel: pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat Ansible Automation Platform 2.2 includes updated Ansible plug-ins for the Red Hat Developer Hub that provide new features, bug fixes, and enhancements to simplify automation for users. The advisory references multiple CVEs including CVE-2026-77037 but does not specify individual vulnerability details or fixes. No patches or remediation actions are currently provided in the advisory.
CVE-2026-68497 is a denial of service vulnerability in the jackson-databind library caused by unbounded numeric parsing. This vulnerability allows an attacker to cause a CPU resource exhaustion, leading to a denial of service condition. The issue affects multiple specific versions of jackson-databind. Red Hat and SUSE have issued security advisories and updates addressing this vulnerability. The vulnerability has a CVSS 3.1 score of 7.5 (medium severity). No known exploits are reported in the wild at this time.