Multiple security vulnerabilities have been identified in the Vim editor on Red Hat Enterprise Linux 10, including command injection during decompression of .tgz archives and arbitrary code execution via crafted directory names, Python omni-completion, and step-definition patterns. These issues have been rated as important by Red Hat Product Security. An update addressing these vulnerabilities is available for Red Hat Enterprise Linux 10 and its variants.
Two security vulnerabilities affecting xorg-x11-server-Xwayland in Red Hat Enterprise Linux 10 have been addressed. These include a heap buffer overflow in the glamor Font Atlas component (CVE-2026-55999) and a use-after-free vulnerability in GLX contextTags within CommonMakeCurrent() (CVE-2026-56000). Both issues are rated with high severity by Red Hat Product Security. An update is available to remediate these vulnerabilities.
This security update provides a functional equivalent of RHSA-2026:33577.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:33577.
A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
A security update has been released for Red Hat Hardened Images RPMs addressing CVE-2026-56289. This update includes patched versions of the 'patch' RPM for aarch64 and x86_64 architectures. The vulnerability is classified with medium severity and relates to a specific security flaw identified by Red Hat Product Security.
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A rich and intuitive set of strongly-typed assertions to use for unit testing (either with JUnit or TestNG).
Security Fix(es):
* assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) (CVE-2026-24400)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Kiali 2.11.14, for Red Hat OpenShift Service Mesh 3.1, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2026-42264 openshift-service-mesh/kiali-rhel9: Axios: Prototype pollution allows information disclosure and request manipulation (OSSM-14595)
* CVE-2026-42264 openshift-service-mesh/kiali-ossmc-rhel9: Axios: Prototype pollution allows information disclosure and request manipulation (OSSM-14600)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified in the unbound DNS resolver packages used in Red Hat Enterprise Linux 8. These include denial of service issues caused by excessive EDNS options, large DNS resource record sets, and degraded resolution performance, as well as a cache manipulation vulnerability via a 'ghost domain names' attack. Red Hat has issued an important security advisory with updates addressing these issues.