Red Hat has released a security advisory for a bug fix and enhancement update to the Red Hat Hardened Images RPMs, including the grype package version 0.119.0-0.1.hum1 for aarch64 and x86_64 architectures. The update addresses two vulnerabilities identified as CVE-2026-63209 and CVE-2026-71557. No detailed technical information about the vulnerabilities or the fixes is provided in the advisory. The update is available through Red Hat's official channels.
A vulnerability exists in the Qt XML parsing component (QDomNode destructor) used in Red Hat Hardened Images RPMs containing qt6-qtbase packages. The flaw can cause unbounded recursion leading to denial-of-service (DoS) crashes when processing untrusted XML input. Currently, no fix has been released and no mitigation meets Red Hat's criteria.
Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings.
Red Hat has released a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana13.2 package to version 13.2.1-0.5.hum1. This update addresses multiple security vulnerabilities including CVE-2026-81871. The advisory indicates a high severity level but does not provide a CVSS score. The update is available for aarch64 and x86_64 architectures. Users of affected versions should apply the update to remediate the vulnerabilities.
A critical vulnerability in GitPython allows bypassing safety checks for dangerous Git options when using Python keyword arguments with underscores, leading to arbitrary command execution. This affects certain Red Hat Satellite container images and related GitPython versions. Red Hat has released a Technology Preview container image addressing this issue but no official fix for Red Hat Satellite is currently available. The vulnerability could allow attackers to execute arbitrary commands if exploited.
Red Hat has released a new container image for the satellite/iop-insights-engine-rhel9 component used in Red Hat Satellite 6.19. This component, Red Hat Lightspeed in Satellite, analyzes system health and configuration locally by applying predefined rules to limited local data. The advisory references CVE-2026-69243 and CVE-2026-69244 but does not provide details on fixes or exploitation. The container image is now generally available, and Red Hat provides documentation for installation and configuration.
CVE-2026-39820 is a critical denial of service vulnerability in the Go net/mail package affecting Red Hat build of MicroShift 4.19, a lightweight Kubernetes orchestration solution for edge devices. The flaw can be triggered by crafted email inputs. Red Hat has released updated packages and container images to address this issue. Users are advised to apply these patches to mitigate the risk. The vulnerability impacts Red Hat OpenShift Container Platform 4.19 for RHEL 9 across multiple architectures. No known exploits in the wild have been reported.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.
This advisory contains OpenShift Virtualization v4.22 images.
Red Hat has announced the general availability of the satellite/iop-host-inventory-frontend-rhel9 container image for Red Hat Satellite 6.19. This container image supports Red Hat Lightspeed, which analyzes system health and configuration locally by applying predefined rules to limited system data. No specific security fixes or patches are mentioned in the advisory. The advisory references multiple CVEs but does not detail any remediation or active exploitation. The container image enables generating recommendations without sending data to Red Hat services.
Red Hat has released a security update for its Hardened Images RPM packages addressing CVE-2026-81871. The update includes distribution package version 3.1.1-0.2.hum1 for aarch64 and x86_64 architectures. This advisory fixes a medium severity vulnerability related to the distribution RPMs. No known exploits are reported in the wild at this time.
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)
* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)
Bug Fix(es) and Enhancement(s):
* Tomcat fails to respond to client connections when using Java 8 [rhel-9.8] (JIRA:RHEL-257456)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).
A critical authentication bypass vulnerability (CVE-2024-52316) affecting Apache Tomcat 10.1.33 and related versions has been addressed in a security update provided by Red Hat and SUSE. The vulnerability involves improper handling of Jakarta Authentication failures that could lead to incorrect HTTP status codes. The update also includes fixes for WebDAV compliance, cache handling, logging, and concurrency issues. Patches are available for multiple affected versions across Red Hat Enterprise Linux and Ubuntu distributions.
A vulnerability in the Red Hat build of Quarkus 3.27.5.SP2's quarkus-websockets-next component allows remote attackers to cause a Denial of Service (DoS) by streaming messages faster than the application can handle. This leads to unbounded message buffering and heap exhaustion, resulting in a java.lang.OutOfMemoryError that crashes the JVM. Red Hat has issued an important security update addressing this and other vulnerabilities in Quarkus 3.27.5.SP2.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)
* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
* kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)
* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
* kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)
* kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)
* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
* kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)
* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
* kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)
* kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
* kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)
* kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)
* kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)
* kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)
* kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
* kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)
* kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)
* kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)
* kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
* kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
* kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)
* kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)
* kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)
* kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)
Bug Fix(es) and Enhancement(s):
* gfs2: filesystem withdrawal rework [rhel-9.8.z] (JIRA:RHEL-252540)
* The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [rhel-9.8.z] (JIRA:RHEL-252544)
* gfs2: Get rid of sd_async_glock_wait [rhel-9.8.z] (JIRA:RHEL-253986)
* [RHEL9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:RHEL-255217)
* [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9.8.z] (JIRA:RHEL-256733)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Kiali 2.27.3, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2026-45623 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15115)
* CVE-2026-45623 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15110)
* CVE-2026-54272 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15124)
* CVE-2026-54272 openshift-service-mesh/kiali-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15125)
* CVE-2026-69153 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15160)
* CVE-2026-69153 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15164)
* CVE-2026-69152 openshift-service-mesh/kiali-ossmc-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15178)
* CVE-2026-69152 openshift-service-mesh/kiali-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15179)
* CVE-2026-69192 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15188)
* CVE-2026-69192 openshift-service-mesh/kiali-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15189)
* CVE-2026-14257 openshift-service-mesh/kiali-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15194)
* CVE-2026-14257 openshift-service-mesh/kiali-ossmc-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15220)
* CVE-2026-73088 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15285)
* CVE-2026-73088 openshift-service-mesh/kiali-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15286)
* CVE-2026-73089 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15299)
* CVE-2026-73089 openshift-service-mesh/kiali-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15300)
* CVE-2026-41178 openshift-service-mesh/kiali-rhel9: OpenTelemetry-Go: Denial of Service via oversized baggage headers (OSSM-15339)
* CVE-2026-67321 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15472)
* CVE-2026-67321 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15473)
* CVE-2026-67313 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15482)
* CVE-2026-67313 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15483)
* CVE-2026-67320 openshift-service-mesh/kiali-ossmc-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15491)
* CVE-2026-67320 openshift-service-mesh/kiali-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15493)
* CVE-2026-67314 openshift-service-mesh/kiali-ossmc-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15496)
* CVE-2026-67314 openshift-service-mesh/kiali-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15497)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-81829 is a path traversal vulnerability in SmallRye JWT's AwsAlbKeyResolver used in Red Hat build of Quarkus 3.27.5.SP2. The flaw allows an unauthenticated remote attacker to manipulate the JWT kid header to cause the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. This can lead to unauthorized reading of non-public or internal data before JWT signature verification occurs. A security update addressing this vulnerability is available from Red Hat.