Threats Tagged 'cve-2026-5928'

Technology Preview features are not fully supported, may not be functionally complete, and are not suitable for deployment in production.

A stack buffer overflow vulnerability (CVE-2025-6170) exists in the libxml2 library's xmllint interactive shell command handling on Red Hat Enterprise Linux 8 and related products. Red Hat has rated the security impact as low. A security update is available that addresses this vulnerability by updating the libxml2 package. No known exploits are reported in the wild.

This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * Punycode labels are no longer processed incorrectly: Before this update, the golang.org/x/net/idna package incorrectly processed certain Punycode labels during internationalized domain name conversion. As a consequence, an attacker could craft a domain name that resolved to a different host than the one that was validated, which could lead to privilege escalation. With this update, Punycode labels are processed correctly. As a result, converted domain names match the validated input. For more information, see https://access.redhat.com/security/cve/cve-2026-39821. * The os.Root type no longer follows symbolic links outside of its root: Before this update, the Go os package did not correctly restrict some operations performed through an os.Root value. As a consequence, an attacker who controlled a symbolic link inside the root directory could traverse outside of it and access files elsewhere on the file system. With this update, operations on an os.Root value are correctly confined to the root directory. As a result, symbolic links can no longer be used to escape the root. For more information, see https://access.redhat.com/security/cve/cve-2026-39822. * The ungetwc function no longer mishandles specific wide character encodings: Before this update, the ungetwc function in the GNU C Library mishandled certain wide character encodings. As a consequence, an application could disclose information or terminate unexpectedly. With this update, the wide character encodings are handled correctly. As a result, the affected applications no longer disclose information or crash. For more information, see https://access.redhat.com/security/cve/cve-2026-5928. * TSIG record processing no longer writes outside the allocated buffer: Before this update, the DNS resolver in the GNU C Library did not correctly validate buffer boundaries when it processed TSIG records. As a consequence, a crafted TSIG record could trigger an out-of-bounds write and cause memory corruption. With this update, the buffer boundaries are validated correctly. As a result, TSIG record processing no longer writes outside the allocated buffer. For more information, see https://access.redhat.com/security/cve/cve-2026-5435. * Crafted DNS responses no longer cause a crash or an uninitialized memory read: Before this update, the DNS resolver in the GNU C Library did not correctly handle malformed responses. As a consequence, a crafted DNS response could cause an application to read uninitialized memory or terminate unexpectedly. With this update, malformed responses are handled correctly. As a result, the affected applications no longer crash or read uninitialized memory. For more information, see https://access.redhat.com/security/cve/cve-2026-6238. Known issues: * None

This security update provides a functional equivalent of RHSA-2026:42828. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:42828.

This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * None Known issues: * None

This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * Punycode labels are no longer processed incorrectly: Before this update, the golang.org/x/net/idna package incorrectly processed certain Punycode labels during internationalized domain name conversion. As a consequence, an attacker could craft a domain name that resolved to a different host than the one that was validated, which could lead to privilege escalation. With this update, Punycode labels are processed correctly. As a result, converted domain names match the validated input. For more information, see https://access.redhat.com/security/cve/cve-2026-39821. * The os.Root type no longer follows symbolic links outside of its root: Before this update, the Go os package did not correctly restrict some operations performed through an os.Root value. As a consequence, an attacker who controlled a symbolic link inside the root directory could traverse outside of it and access files elsewhere on the file system. With this update, operations on an os.Root value are correctly confined to the root directory. As a result, symbolic links can no longer be used to escape the root. For more information, see https://access.redhat.com/security/cve/cve-2026-39822. * The ungetwc function no longer mishandles specific wide character encodings: Before this update, the ungetwc function in the GNU C Library mishandled certain wide character encodings. As a consequence, an application could disclose information or terminate unexpectedly. With this update, the wide character encodings are handled correctly. As a result, the affected applications no longer disclose information or crash. For more information, see https://access.redhat.com/security/cve/cve-2026-5928. * TSIG record processing no longer writes outside the allocated buffer: Before this update, the DNS resolver in the GNU C Library did not correctly validate buffer boundaries when it processed TSIG records. As a consequence, a crafted TSIG record could trigger an out-of-bounds write and cause memory corruption. With this update, the buffer boundaries are validated correctly. As a result, TSIG record processing no longer writes outside the allocated buffer. For more information, see https://access.redhat.com/security/cve/cve-2026-5435. * Crafted DNS responses no longer cause a crash or an uninitialized memory read: Before this update, the DNS resolver in the GNU C Library did not correctly handle malformed responses. As a consequence, a crafted DNS response could cause an application to read uninitialized memory or terminate unexpectedly. With this update, malformed responses are handled correctly. As a result, the affected applications no longer crash or read uninitialized memory. For more information, see https://access.redhat.com/security/cve/cve-2026-6238. Known issues: * None

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update includes the following RPMs: glibc: * compat-libpthread-nonshared-2.42-12.hum1 (aarch64, x86_64) * glibc-2.42-12.hum1 (aarch64, x86_64) * glibc-all-langpacks-2.42-12.hum1 (aarch64, x86_64) * glibc-benchtests-2.42-12.hum1 (aarch64, x86_64) * glibc-common-2.42-12.hum1 (aarch64, x86_64) * glibc-devel-2.42-12.hum1 (aarch64, x86_64) * glibc-doc-2.42-12.hum1 (noarch) * glibc-gconv-extra-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-aa-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-af-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-agr-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ak-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-am-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-an-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-anp-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ar-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-as-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ast-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ayc-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-az-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-be-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bem-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ber-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bg-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bhb-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bho-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bi-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bn-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bo-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-br-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-brx-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-bs-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-byn-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ca-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ce-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-chr-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ckb-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-cmn-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-crh-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-cs-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-csb-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-cv-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-cy-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-da-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-de-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-doi-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-dsb-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-dv-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-dz-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-el-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-en-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-eo-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-es-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-et-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-eu-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fa-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ff-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fi-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fil-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fo-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fr-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fur-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-fy-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ga-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gbm-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gd-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gez-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gl-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gu-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-gv-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ha-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hak-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-he-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hi-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hif-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hne-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hr-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hsb-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ht-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hu-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-hy-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ia-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-id-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ig-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ik-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-is-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-it-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-iu-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ja-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-ka-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-kab-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-kk-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-kl-2.42-12.hum1 (aarch64, x86_64) * glibc-langpack-km-2.4

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.