This update for busybox fixes the following issue
- CVE-2026-29004: a crafted DHCPv6 response can lead to a heap buffer overflow in the DHCPv6 client (bsc#1263989).
Red Hat Advanced Cluster Management for Kubernetes 2.13 images
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html-single/release_notes/index#acm-release-notes
The multicluster engine for Kubernetes v2.8 images
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
* vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
* vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
* vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636)
* kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
* kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
* kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
* kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)
* kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
* kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)
Bug Fix(es) and Enhancement(s):
* Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.
Red Hat build of Keycloak is an integrated sign-on solution,
available as a Red Hat JBoss Middleware for OpenShift containerized
image. The Red Hat build of Keycloak for OpenShift image provides
an authentication server that you can use to log in centrally, log
out, and register. You can also manage user accounts for web
applications, mobile applications, and RESTful web services.
Red Hat build of Keycloak Operator for OpenShift simplifies
deployment and management of Keycloak 26.4.13 clusters.
This erratum releases new images for Red Hat build of Keycloak
26.4.13 for use within the OpenShift Container Platform cloud
computing Platform-as-a-Service (PaaS) for on-premise or private
cloud deployments, aligning with the standalone product release.
Security fixes:
* Information disclosure via CORS header injection due to unvalidated JWT azp claim (CVE-2026-37977)
* Server-Side Request Forgery via OIDC token endpoint manipulation (CVE-2026-4874)
* eclipse-vertx/vert.x:Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860)
* Improper Access Control on Keycloak Server when the account Account API feature is disabled (CVE-2026-7500)
* Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation (CVE-2026-8830)
* Security flaw in org.keycloak/keycloak-services (CVE-2026-8922)
* Information disclosure through arbitrary filesystem path probing (CVE-2026-9083)
* Cross-site scripting (XSS) via case-insensitive URI validation bypass (CVE-2026-9086)
* Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login (CVE-2026-9087)
* Information disclosure due to user profile permission bypass (CVE-2026-9088)
* Group-Admin Escalation to Realm-Admin (CVE-2026-9099)
* Privilege escalation due to oversized subject_token JWT (CVE-2026-9704)
* Attacker can re-enable and take over disabled clients via Registration Access Token (CVE-2026-9705)
* Organization Data Leak After Feature Disabled in Keycloak (CVE-2026-9791)
* Security restriction bypass allows unauthorized ROPC token acquisition (CVE-2026-9792)
* Information disclosure via SAML ECP endpoint (CVE-2026-9794)
* Privilege escalation via improper scope mapping enforcement (CVE-2026-9795)
* Unauthorized access to resources via UMA permission ticket bypass (CVE-2026-9799)
* Authorization bypass via incorrect URI comparison (CVE-2026-9800)
* Denial of Service via malformed LDAP password policy response (CVE-2026-9801)
* Unauthorized account access via replayed refresh tokens after cluster restart (CVE-2026-9802)
* Denial of Service via malformed Authorization header (CVE-2026-9803)
This update includes the following RPMs:
jq:
* jq-1.8.2-0.1.hum1 (aarch64, x86_64)
* jq-devel-1.8.2-0.1.hum1 (aarch64, x86_64)
* jq-1.8.2-0.1.hum1.src (src)
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.15.66. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:28961
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/
Security Fix(es):
* kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
* OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode (CVE-2026-35385)
* kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243)
* kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.92. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:26527
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes