RHSA-2026:10999HighCVSS 7.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
April 27, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (3)

CVE-2026-44028 →CVE-2026-44029 →CVE-2026-47423 →

📋 Description

CVE-2026-44028 — nix: coroutine stack-to-heap overflow via unbounded recursion in NAR directory parser CVE-2026-44029 — nix: absolute path traversal when unpacking archives to disk CVE-2026-47423 — dompurify: DOMPurify: Cross-site scripting vulnerability allows information disclosure

🎯 Affected products6

  • Red Hat Hardened Images
  • python3-ruff-0:0.15.11-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • python3-ruff-0:0.15.11-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • ruff-0:0.15.11-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • ruff-0:0.15.11-1.hum1@src as a component of Red Hat Hardened Images
  • ruff-0:0.15.11-1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: There is no direct mitigation for this flaw other than updating the DOMPurify library when upstream patches are available. As a defense-in-depth measure, Content Security Policy (CSP) headers that restrict inline script execution can help reduce the impact of XSS vulnerabilities. This issue is fixed in version 3.4.5.

🔗 References (7)