Red Hat has released a security advisory for a bug fix and enhancement update to the Red Hat Hardened Images RPMs, specifically addressing the chunkah package version 0.7.0-1.1.hum1. This update addresses the vulnerability identified as CVE-2026-84782. The advisory does not provide detailed technical information about the vulnerability but classifies it as high severity. The update is available for affected versions including chunkah 0.7.0-1.1.hum1 on aarch64 and x86_64 architectures.
Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience.
This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 6 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 5, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section.
Security Fix(es):
* jbcs-httpd24-httpd: HTTP response splitting forwarding malicious status line (CVE-2026-33523)
* mod_auth_digest.so: timing attack allows a bypass of digest authentication (CVE-2026-33006)
A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-687.10.1.el9_8.
Security Fix(es):
* kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.
Security Fix(es):
* gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296)
* gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298)
* gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299)
* GStreamer: GStreamer: Remote code execution via MRF file parsing (CVE-2026-18295)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.
CVE-2026-102473 is a medium severity vulnerability in the dash shell used by Red Hat Enterprise Linux 6. It involves inefficient regular expression complexity in the internal pmatch() matcher when built without libc fnmatch. A local user able to influence filenames or input to the matcher can cause excessive CPU consumption by using a short multi-star pattern such as '*.*.*.*.*.tar.gz'. This results in a denial of service through resource exhaustion but does not impact confidentiality or integrity.
Red Hat issued a security advisory for Multicluster Global Hub 1.8.2 addressing a high severity vulnerability identified as CVE-2026-17106. The vulnerability affects the component managing multiple hub clusters from a single hub cluster. The advisory includes updates to Red Hat Hardened Images RPMs, specifically podman packages. A fix is available in updated packages including podman-6.0.2-2.2.hum1. Instructions for applying the update are provided by Red Hat.
CVE-2026-97029 is a vulnerability in Flatpak's process ID namespace separation on Red Hat Enterprise Linux 10. It allows a sandboxed Flatpak application to send kill signals to processes outside its sandbox that share the same process group, potentially causing denial of service by terminating critical processes such as the desktop shell. The vulnerability has a medium severity with a CVSS score of 5.7.
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
The IBM Semeru Runtime Certified Edition 21 runtime environment.
Security Fix(es):
* OpenJDK: Improve Resource Resolving (2026-08 Security Update) (CVE-2026-60589)
* OpenJDK: Enhance HTTP Connections (2026-08 Security Update) (CVE-2026-61308)
* OpenJDK: Enhance TLS server (2026-08 Security Update) (CVE-2026-70907)
* openj9: Eclipse OpenJ9: Denial of Service via crafted .class file (CVE-2026-16440)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html-single/release_notes/index#acm-release-notes
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.14/html-single/release_notes/index#acm-release-notes
This update includes the following RPMs:
opentelemetry-collector:
* opentelemetry-collector-0.157.0-0.1.hum1 (aarch64, x86_64)
* opentelemetry-collector-0.157.0-0.1.hum1.src (src)
Security Fix(es):
opentelemetry-collector:
* CVE-2026-56852
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)
* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
CVE-2026-97027 is a vulnerability in Red Hat Enterprise Linux 10 involving improper input validation by Flatpak when exporting application Desktop Entry and D-Bus Service files. This flaw allows a malicious Flatpak application to cause denial of service conditions such as forced application restart loops or to influence host D-Bus/systemd activation behavior beyond sandbox restrictions. The vulnerability has a medium severity score and impacts availability but does not affect confidentiality or integrity.