Threats Tagged 'cve-2026-59885'

Red Hat AI Inference 3.4.6 (rocm) is identified with multiple security vulnerabilities including CVE-2026-15679. The advisory lists numerous CVEs affecting the Red Hat AI Inference Server but does not provide details on specific vulnerabilities or fixes. No patches or remediation steps are currently available as per the vendor advisory.

Red Hat Enterprise Linux AI 3.3.6 update addresses multiple security vulnerabilities affecting the AI Inference Server Model Optimization Tools. The update provides enhanced container images to mitigate these issues. The vulnerabilities include a range of weaknesses such as improper input validation and memory handling errors. The update is classified as important and addresses several CVEs. No active exploits are known in the wild at this time.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.22.7. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:44237 Security Fix(es): * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization (CVE-2026-13676) * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The multicluster engine for Kubernetes v2.10 images The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.14/html-single/release_notes/index#acm-release-notes

A denial of service vulnerability exists in the pyasn1 library's BER/CER/DER decoders and encoders when processing OBJECT IDENTIFIER and RELATIVE-OID values. The vulnerability arises from quadratic time complexity relative to the number of arcs in these values, allowing crafted payloads with many arcs to consume excessive CPU time. This affects applications decoding untrusted ASN.1 data such as certificates, LDAP, SNMP, and Kerberos. The issue is fixed in pyasn1 version 0.6.4, which improves the processing to linear time. Users should upgrade to this version or later to mitigate the risk.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) * automation-eda-controller: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN (CVE-2026-12383) * automation-eda-controller: Authentication bypass in Event-Driven Ansible via forged HTTP header (CVE-2026-18141) * automation-gateway-proxy: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * python3.12-aiohttp: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993) * python3.12-daphne: daphne: Denial of Service via excessive WebSocket message size (CVE-2026-44545) * python3.12-pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) * python3.12-pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) * python3.12-pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) * python3.12-pillow: Denial of Service via crafted PCF font data (CVE-2026-54059) * python3.12-pillow: Native heap out-of-bounds write (CVE-2026-59197) * python3.12-pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) * python3.12-pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885) * receptor: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers (CVE-2026-40898) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details about this release, refer to the release notes listed in the References section.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) * automation-eda-controller: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN (CVE-2026-12383) * automation-gateway-proxy: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * python3.12-aiohttp: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993) * python3.12-daphne: daphne: Denial of Service via excessive WebSocket message size (CVE-2026-44545) * python3.12-pillow: Denial of Service via crafted PCF font data (CVE-2026-54059) * python3.12-pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) * python3.12-pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) * python3.12-pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) * python3.12-pillow: Native heap out-of-bounds write (CVE-2026-59197) * python3.12-pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59885) * python3.12-pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59886) * receptor: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers (CVE-2026-40898) * receptor: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details about this release, refer to the release notes listed in the References section.

This update includes the following RPMs: jaeger: * jaeger-2.19.0-1.1.hum1 (aarch64, x86_64) * jaeger-2.19.0-1.1.hum1.src (src) Security Fix(es): jaeger: * CVE-2026-59884 * CVE-2026-59885