Threats Tagged 'cve-2026-63076'

This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * Punycode labels are no longer processed incorrectly: Before this update, the golang.org/x/net/idna package incorrectly processed certain Punycode labels during internationalized domain name conversion. As a consequence, an attacker could craft a domain name that resolved to a different host than the one that was validated, which could lead to privilege escalation. With this update, Punycode labels are processed correctly. As a result, converted domain names match the validated input. For more information, see https://access.redhat.com/security/cve/cve-2026-39821. * The os.Root type no longer follows symbolic links outside of its root: Before this update, the Go os package did not correctly restrict some operations performed through an os.Root value. As a consequence, an attacker who controlled a symbolic link inside the root directory could traverse outside of it and access files elsewhere on the file system. With this update, operations on an os.Root value are correctly confined to the root directory. As a result, symbolic links can no longer be used to escape the root. For more information, see https://access.redhat.com/security/cve/cve-2026-39822. * The ungetwc function no longer mishandles specific wide character encodings: Before this update, the ungetwc function in the GNU C Library mishandled certain wide character encodings. As a consequence, an application could disclose information or terminate unexpectedly. With this update, the wide character encodings are handled correctly. As a result, the affected applications no longer disclose information or crash. For more information, see https://access.redhat.com/security/cve/cve-2026-5928. * TSIG record processing no longer writes outside the allocated buffer: Before this update, the DNS resolver in the GNU C Library did not correctly validate buffer boundaries when it processed TSIG records. As a consequence, a crafted TSIG record could trigger an out-of-bounds write and cause memory corruption. With this update, the buffer boundaries are validated correctly. As a result, TSIG record processing no longer writes outside the allocated buffer. For more information, see https://access.redhat.com/security/cve/cve-2026-5435. * Crafted DNS responses no longer cause a crash or an uninitialized memory read: Before this update, the DNS resolver in the GNU C Library did not correctly handle malformed responses. As a consequence, a crafted DNS response could cause an application to read uninitialized memory or terminate unexpectedly. With this update, malformed responses are handled correctly. As a result, the affected applications no longer crash or read uninitialized memory. For more information, see https://access.redhat.com/security/cve/cve-2026-6238. Known issues: * None

Red Hat Cost Management On-Premise provides cost visibility and analysis for on-premise OpenShift environments. This update includes the latest bug fixes and enhancements.

This update includes the following RPMs: nodejs24: * nodejs24-24.18.1-0.1.hum1 (aarch64, x86_64) * nodejs24-bin-24.18.1-0.1.hum1 (noarch) * nodejs24-devel-24.18.1-0.1.hum1 (aarch64, x86_64) * nodejs24-docs-24.18.1-0.1.hum1 (noarch) * nodejs24-full-i18n-24.18.1-0.1.hum1 (aarch64, x86_64) * nodejs24-libs-24.18.1-0.1.hum1 (aarch64, x86_64) * nodejs24-npm-11.16.0-1.24.18.1.0.1.hum1 (noarch) * nodejs24-npm-bin-24.18.1-0.1.hum1 (noarch) * v8-13.6-devel-13.6.233.17-1.24.18.1.0.1.hum1 (aarch64, x86_64) * nodejs24-24.18.1-0.1.hum1.src (src)

Multiple security vulnerabilities have been identified in PostgreSQL, an advanced object-relational database management system, including arbitrary code execution, privilege escalation, and information disclosure issues. These vulnerabilities affect various PostgreSQL components such as tsvector and tsquery functions, psql COPY FROM STDIN, logical decoding plugins, and others. The vulnerabilities are rated with high severity and impact critical database operations. Red Hat has issued security advisories and updates addressing these issues for affected Red Hat Enterprise Linux versions.

A security update has been issued for Red Hat Update Infrastructure (RHUI) container images, addressing vulnerabilities including CVE-2026-13221. The update involves multiple RPM packages related to Perl and Red Hat Hardened Images. The advisory indicates a high severity level but does not provide detailed technical specifics or CVSS scores. The update is intended to mitigate security issues in affected versions of RHUI.

A security update for Red Hat Hardened Images addresses multiple vulnerabilities in OpenSSL 3, including memory growth issues, heap buffer overflows, invalid pointer dereferences, and cryptographic forgery risks. These vulnerabilities affect components such as QUIC server processing, CMP response validation, and PKCS#12 file handling. The update fixes these issues in OpenSSL version 3.5.6-0.5.hum1 and related packages. The update is available and should be applied to mitigate the risks.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including multiple OpenSSL packages. This update addresses several vulnerabilities identified by multiple CVEs, including CVE-2026-14457 and others. The advisory provides updated RPM packages for architectures aarch64 and x86_64. No specific details about the vulnerabilities or their exploitation are provided in the advisory. The update is intended as a bug fix and enhancement for the affected OpenSSL components.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to several openssl3 packages. This update addresses multiple vulnerabilities identified by various CVEs, including CVE-2026-14457 and others. The advisory provides updated RPM versions for openssl3 and related development packages for aarch64 and x86_64 architectures. No explicit fix details or exploitation information is provided in the advisory.

A vulnerability in Node.js related to OpenSSL CMP password-based protection verification causes the check to only verify that the protectionAlg parameter is not NULL, without properly validating its ASN.1 structure. This issue is tracked as CVE-2026-63076 and affects multiple specific Node.js versions, primarily in Ubuntu packages. The vulnerability has a CVSS score of 7.5, indicating a medium severity with a potential impact on availability. A patch is available to address this issue.