A heap-based buffer overflow vulnerability exists in the tiff2pdf utility of libtiff used in Red Hat Hardened Images. The flaw is due to an integer truncation error when processing crafted BigTIFF files, causing a 64-bit value to be truncated to 32-bit, leading to undersized memory allocation and out-of-bounds memory copy. This can result in a crash and severe memory corruption. Red Hat has released an update to address this issue.
A heap out-of-bounds read vulnerability exists in the cupsUTF32ToUTF8() function of the CUPS printing system due to missing source-length bounds during SNMP supply-description parsing. This vulnerability is tracked as CVE-2026-87875 and affects multiple versions of CUPS included in Red Hat Hardened Images. A security update has been issued by Red Hat to address this issue.
A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive information, the service returns the client's confidential secret in cleartext. This could allow a read-only administrator to obtain full access to the affected client's account and potentially escalate their privileges within the realm.
Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.
Security Fix(es):
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.(CVE-2026-77159)
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
* openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.
CVE-2026-88914 is a medium severity vulnerability in the GStreamer gst-plugins-good isomp4 plugin used in Red Hat Enterprise Linux 10. It involves an integer overflow in 32-bit unsigned arithmetic when processing specially crafted MP4 or MOV files containing CEA-608 closed-caption data. This overflow bypasses a bounds check in the caption parser, leading to an out-of-bounds heap read of up to 244 bytes. Exploitation requires user interaction by opening a malicious media file and may result in disclosure of adjacent heap memory or application crash.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.44. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:57401
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/
A vulnerability in the GridFS component of the MongoDB Python Driver (pymongo) allows improper neutralization of special elements in data query logic. This flaw can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may access stored file content beyond the intended target, delete all GridFS file chunks in the affected bucket, or cause unintended file renaming.
A vulnerability in GNU tar (CVE-2026-5704) allows specially crafted archive files to cause tar to improperly overwrite files. This can enable attackers to inject hidden files with attacker-controlled content, bypassing pre-extraction inspection mechanisms. The issue affects multiple versions of tar across various Linux distributions including Ubuntu and openSUSE. Fixes have been released for supported Ubuntu LTS releases and openSUSE Tumbleweed. Users are advised to update to the fixed package versions to mitigate the risk.
GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.
When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.
When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.
This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs that includes an update to the Trivy package addressing vulnerabilities identified as CVE-2026-71556 and CVE-2026-15789. These vulnerabilities relate to security weaknesses classified under CWE-22 (Path Traversal) and CWE-59 (Link Following). The update includes version 0.74.0-0.2.hum1 of Trivy for aarch64 and x86_64 architectures. No explicit patch details are provided beyond the availability of this update.
Red Hat has issued an important security update for Red Hat JBoss Enterprise Application Platform 7.4 addressing multiple vulnerabilities. These include unauthenticated queue creation and session hijacking in Apache Artemis, as well as privilege escalation and unexpected property modification issues in jackson-databind. The vulnerabilities affect Red Hat JBoss EAP 7.4 versions for RHEL 7, 8, and 9. The update mitigates these issues to improve platform security.
Multiple security vulnerabilities have been identified in Vim (Vi IMproved) editor affecting Red Hat Enterprise Linux 10 and its variants. These include information disclosure, denial of service, and arbitrary code execution issues triggered by crafted Unicode characters, spell files, vimball files, netrw menu entries, and insecure shell command handling. Red Hat has issued an important security advisory with updates to address these vulnerabilities.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.16.70. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:62548
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/
Security Fix(es):
* unbound: Unbound Cache poisoning (CVE-2025-5994)
* sqlite: Integer Truncation in SQLite (CVE-2025-6965)
* podman: Podman kube play command may overwrite host files (CVE-2025-9566)
* libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)
* libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)
* kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)
* bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)
* samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
* bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)
* dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)
* bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
* bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)
* dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
* openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230)
* samba: vfs_worm does not block directory modification (CVE-2026-2340)
* gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833)
* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)
* systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
Multiple vulnerabilities have been identified in osbuild-composer, a Red Hat service used for building customized OS artifacts, including certificate validation bypass, denial of service, and cross-site scripting issues in Go language components. These affect Red Hat Enterprise Linux 10 and related products. A patch is available to address these security flaws.
Multiple security vulnerabilities have been identified and fixed in the Linux kernel packages distributed by Red Hat. These include issues such as use-after-free, double-free, TOCTOU race conditions, and improper handling of network protocols and cryptographic requests. The update addresses a broad range of kernel subsystems and architectures. A patch is available to remediate these vulnerabilities.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including an update to the 'hugo' package version 0.166.0-0.1.hum1 for aarch64 and x86_64 architectures. This update addresses multiple vulnerabilities identified by several CVEs. The advisory provides updated RPMs to fix bugs and enhance security. No explicit CVSS score is provided, but the severity is marked as high.
Red Hat has issued a critical security advisory updating container images for HawtIO 4.4.1 used in the Red Hat build of Apache Camel 4. These updated images include backported patches addressing security issues, bugs, and enhancements. Users are advised to upgrade to these updated container images and rebuild any dependent images. The advisory references two CVEs (CVE-2026-77968 and CVE-2026-78234) and is linked to Red Hat security advisories RHSA-2026:66120 and RHSA-2026:42952. No specific affected software versions are detailed in the advisory. No known exploits in the wild have been reported. The vendor provides updated container images via the Red Hat Container Registry and recommends updating Dockerfiles accordingly.