Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to Rust-related packages such as cargo. The advisory references CVE-2025-11233 and other CVEs but does not specify any fixes or patches included in this update. The update is described as a bug fix and enhancement update without detailed vulnerability remediation information.
A heap-based buffer overflow vulnerability (CVE-2026-53910) exists in the diff3 program of the diffutils package included in Red Hat Hardened Images. This flaw arises from multiple signed integer overflows in line-mapping calculations when processing specially crafted diff output, potentially causing denial of service or memory corruption. Exploitation requires control over the diff output used by diff3 or convincing a user to run diff3 with malicious input, often requiring prior execution privileges. The vulnerability is rated as low severity by Red Hat.
This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel packages used in Red Hat Enterprise Linux 7 Extended Lifecycle Support and related variants. The key security fixes include validation of nested VLAN headers (CVE-2026-31684), improved checks in netfilter's xt_tcpmss module (CVE-2026-43190), and correction of a wifi mac80211 issue (CVE-2026-46152). Additional kernel fixes address race conditions and panic scenarios. These updates are important to maintain kernel security and stability. A system reboot is required after applying the update.
This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements.
Breaking changes:
* None
Deprecations:
* None
Technology Preview features:
* None
Enhancements:
* None
Bug fixes:
* Punycode labels are no longer processed incorrectly: Before this update, the golang.org/x/net/idna package incorrectly processed certain Punycode labels during internationalized domain name conversion. As a consequence, an attacker could craft a domain name that resolved to a different host than the one that was validated, which could lead to privilege escalation. With this update, Punycode labels are processed correctly. As a result, converted domain names match the validated input. For more information, see https://access.redhat.com/security/cve/cve-2026-39821.
* The os.Root type no longer follows symbolic links outside of its root: Before this update, the Go os package did not correctly restrict some operations performed through an os.Root value. As a consequence, an attacker who controlled a symbolic link inside the root directory could traverse outside of it and access files elsewhere on the file system. With this update, operations on an os.Root value are correctly confined to the root directory. As a result, symbolic links can no longer be used to escape the root. For more information, see https://access.redhat.com/security/cve/cve-2026-39822.
* The ungetwc function no longer mishandles specific wide character encodings: Before this update, the ungetwc function in the GNU C Library mishandled certain wide character encodings. As a consequence, an application could disclose information or terminate unexpectedly. With this update, the wide character encodings are handled correctly. As a result, the affected applications no longer disclose information or crash. For more information, see https://access.redhat.com/security/cve/cve-2026-5928.
* TSIG record processing no longer writes outside the allocated buffer: Before this update, the DNS resolver in the GNU C Library did not correctly validate buffer boundaries when it processed TSIG records. As a consequence, a crafted TSIG record could trigger an out-of-bounds write and cause memory corruption. With this update, the buffer boundaries are validated correctly. As a result, TSIG record processing no longer writes outside the allocated buffer. For more information, see https://access.redhat.com/security/cve/cve-2026-5435.
* Crafted DNS responses no longer cause a crash or an uninitialized memory read: Before this update, the DNS resolver in the GNU C Library did not correctly handle malformed responses. As a consequence, a crafted DNS response could cause an application to read uninitialized memory or terminate unexpectedly. With this update, malformed responses are handled correctly. As a result, the affected applications no longer crash or read uninitialized memory. For more information, see https://access.redhat.com/security/cve/cve-2026-6238.
Known issues:
* None
This update includes the following RPMs:
cosign:
* cosign-3.1.2-0.2.hum1 (aarch64, x86_64)
* cosign-3.1.2-0.2.hum1.src (src)
Security Fix(es):
cosign:
* CVE-2026-56852
Apache Tomcat's LockOutRealm component has a vulnerability due to improper handling of case sensitivity in user names. This flaw allows remote attackers to potentially bypass account lockout protections and obtain sensitive information. Multiple Apache Tomcat versions are affected, and official patches are available. Users should update to fixed versions and restart Tomcat to apply the changes.
A security advisory from Red Hat addresses vulnerabilities in the policycoreutils packages used in Red Hat Hardened Images. The main issue is missing authorization checks in the seunshares component, which allows a local unconfined SELinux user to terminate other unconfined processes, including those owned by root, potentially causing denial of service. The advisory covers multiple updated RPM packages to address these issues. Default SELinux confinement reduces the attack surface. No explicit patch is currently available according to the advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.13.69. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:40020
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes
Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available.
The purpose of this text-only errata is to inform you about the security issues fixed.
Security Fix(es):
* vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects (CVE-2026-15075)
* jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision (CVE-2026-10050)
* rhaf-camel-spring-boot-maven-repository.zip: Apache Qpid Proton-J: Denial of Service via unbounded type nesting (CVE-2026-66274)
* jetty-server: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections (CVE-2026-10051)
* sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation (CVE-2026-56624)
* cxf-rt-transports-jms: Apache CXF: Remote Code Execution via unsafe deserialization of JMS ObjectMessage (CVE-2026-66909)
* cxf-rt-rs-security-oauth2: Apache CXF: Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider (CVE-2026-68079)
* cxf-rt-rs-security-oauth2: Apache CXF: Authorization Code Replay via Race Condition (CVE-2026-57818)
* cxf: Apache CXF: Authorization Code Substitution via missing c_hash validation (CVE-2026-57817)
* camel: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers (CVE-2026-46457)
* camel: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers (CVE-2026-46456)
* camel: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields (CVE-2026-48203)
* camel-amqp: Apache Camel: Information disclosure via deserialization of untrusted data (CVE-2026-42527)
* proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation (CVE-2026-66273)
* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching (CVE-2026-66257)
* netty-codec-xml: Netty: Denial of Service via CPU Exhaustion in XmlFrameDecoder (CVE-2026-73507)
* micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing (CVE-2026-59296)
* cxf-rt-rs-security-oauth2: Apache CXF: Security bypass due to improper handling of authorization parameters (CVE-2026-63687)
* camel-knative: Apache Camel Knative: Header injection vulnerability allows server-side request forgery (CVE-2026-63621)
* camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component (CVE-2026-66908)
* netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration (CVE-2026-62243)
* httpclient5-cache: Apache HttpComponents Client: Denial of Service due to connection leak (CVE-2026-64607)
* jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
* zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability (CVE-2026-87825)
* zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service (CVE-2026-87877)
* zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (CVE-2026-87824)
* zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service (CVE-2026-87795)
* zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read (CVE-2026-89046)
* jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)
* zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress (CVE-2026-90560)
* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)
* bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)
* zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing (CVE-2026-90852)
* netty-transport-sctp: Netty: Denial of Service via SCTP memory exhaustion (CVE-2026-59902)
* camel-mail: Apache Camel: Injected MIME headers can manipulate route behavior (CVE-2026-59230)
* netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-4.18.0-553.53.1.el8_10.
Security Fix(es):
* kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-427.68.2.el9_4.
Security Fix(es):
* kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)
* kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A signed integer overflow vulnerability exists in libarchive's ZIP writer when ZIP encryption is enabled and the entry file size is near the maximum 64-bit integer value. This overflow can cause undefined behavior such as incorrect Zip64 extension decisions or potential memory corruption. The vulnerability is rated low severity by Red Hat due to the highly contrived conditions required for exploitation and limited impact. A security update for Red Hat Hardened Images RPMs including libarchive packages addresses this issue.
OpenShift API for Data Protection (OADP) enables you to back up and restore
application resources, persistent volume data, and internal container
images to external backup storage. OADP enables both file system-based and
snapshot-based backups for persistent volumes.
This update for unbound fixes the following issues:
Update to version 1.25.2.
Security issues fixed:
- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).
- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).
- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries
(bsc#1271891).
- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records
(bsc#1271892).
- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly
terminated (bsc#1271876).
- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate
parent's `NXDOMAIN` (bsc#1271893).
- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).
- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply
path (bsc#1271894).
- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed
parent (bsc#1271878).
- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).
- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).
- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).
- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).
- CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874).
- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).
- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name
(bsc#1271889).
- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are
combined in unusual configuration (bsc#1271890).
Other updates and bugfixes:
- Version 1.25.2:
+ Features:
* TTL behavior changes: cached records reaching TTL 0 are expired;
TTL 0 upstream answers are no longer cached by cachedb;
serve-expired-reply-ttl is now capped by the original TTL value;
TTL decoding updated to adhere to RFC 8767 section 4
* Add new statistics: num.queries.replyaddr_limit and
requestlist.current.replies
* Add 'log-thread-id' configuration option to log the system-wide
Linux thread ID for easier debugging
* Add ECC-GOST12 support per RFC 9558 (available as
contrib/gost12.patch)
* Allow synthesized DNAME TTL=0 to be served from cache within a
1-second grace period, reducing recursion for TTL=0 DNAMEs
(RFC 2308)
* Fix DoT/DoH/DoQ to reload certificates on config reload without
requiring a full restart; fast_reload now supports changes to
tls-service-key, tls-service-pem and tls-cert-bundle
* Allow ip@port notation in control-interface configuration
* Add iter-scrub-rrsig option (default: 8) to limit the number of
RRSIGs processed by the scrubber
* Add 'tls-protocols' configuration option to select which TLS
protocol versions are used; TLSv1.2 is re-enabled by default
* Add pthread_setname_np support for named threads
+ Bug Fixes:
* Fix handle leak in pythonmod on pythonmod_init
* Fix crash when mesh_detect_cycle_found() is called with no mesh
state
* Fix modstack_call_init to use the original string when it has
changed
* Fix fr_atomic_copy_cfg
* Fix auth-zone empty label for $ORIGIN when downloading via HTTP
* Fix respip and dns64 to be usable simultaneously; RPZ now works
with DNS64
* Fix HTTPS and QUIC not being enabled when port is listed in
interface-automatic-ports
* Allow wait-limit-cookie: 0 to disable cookie-validated wait limits
* Fix FIPS mode in OpenSSL causing unit test failure
* Fix discard-timeout to only drop UDP, not stream connections
* Reply with SERVFAIL when the wait-limit is exceeded
* A
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple unbound-related packages to version 1.25.2-0.1.hum1. This update addresses a high severity vulnerability identified as CVE-2026-40691. The advisory provides updated RPM packages for various architectures and includes bug fixes and enhancements. No explicit details about the nature of the vulnerability or exploitation are provided in the advisory. No known exploits in the wild have been reported at this time.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.39. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:40761
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/
Security Fix(es):
* dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)
* dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)
* dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)
* gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerability (CVE-2026-42009)
* gnutls: gnutls: Authentication Bypass via NUL Character in Username (CVE-2026-42010)
* dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)
* gnutls: gnutls: Information disclosure via heap overread in RSA key exchange (CVE-2026-5260)
* glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450)
* gnutls: gnutls: Security bypass due to incorrect name constraint handling (CVE-2026-42011)
* gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name (CVE-2026-42013)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.