RHSA-2026:62531HighCVSS 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
September 2, 2026
Last Modified
October 2, 2026

🔗 CVE IDs covered (8)

CVE-2026-73270 →CVE-2026-73812 →CVE-2026-74835 →CVE-2026-74994 →CVE-2026-66835 →CVE-2026-69664 →CVE-2026-70399 →CVE-2026-70409 →

📋 Description

CVE-2026-66835 — inets: Erlang/OTP inets httpd: Directory protection bypass allows information disclosure CVE-2026-69664 — otp: inets: Erlang/OTP inets httpd: Denial of Service via malformed chunked HTTP request CVE-2026-70399 — inets: inets: Denial of Service via unenforced connection limit CVE-2026-70409 — eldap: eldap: Denial of Service via long LDAP referral URL port CVE-2026-73270 — erlang: inets: Erlang/OTP inets httpd: Information disclosure via case-insensitive path bypass CVE-2026-73812 — OTP: inets: inets: HTTP Request Smuggling allows bypassing security controls CVE-2026-74835 — inets: httpd: otp: inets httpd: Denial of Service due to memory exhaustion via unenforced body-size limit CVE-2026-74994 — inets: otp: inets httpd mod_auth: Authentication Bypass via Directory Namespace Collapse

🎯 Affected products80

  • Red Hat Hardened Images
  • erlang27-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-0:27.3.4.17-0.1.hum1@src as a component of Red Hat Hardened Images
  • erlang27-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-asn1-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-asn1-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-common_test-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-common_test-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-compiler-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-compiler-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-crypto-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-crypto-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-debugger-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-debugger-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-dialyzer-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-dialyzer-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-diameter-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-diameter-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-edoc-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-edoc-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-eldap-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-eldap-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-erl_interface-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-erl_interface-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-erts-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-erts-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-et-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-et-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • erlang27-eunit-0:27.3.4.17-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • erlang27-eunit-0:27.3.4.17-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • +50 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, restrict network access to the Erlang/OTP inets httpd instance to trusted clients only. Alternatively, deploy a reverse proxy in front of the inets httpd that normalizes doubled slashes in request paths before forwarding, such as configuring nginx with its default merge_slashes directive. If inets httpd is not required, consider disabling the service. If the service is active, ensure that sensitive content is served through explicitly authenticated handlers rather than relying solely on mod_auth directory-block matching. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the criteria for a supported mitigation. Red Hat will update this section as more information becomes available. Workaround: To mitigate this issue, explicitly configure the `max_clients` option in the Erlang/OTP inets httpd server configuration to a reasonable value. This will enforce a limit on simultaneous connections, preventing resource exhaustion. Consult the Erlang/OTP inets documentation for specific configuration instructions. A restart or reload of the affected service may be required for the changes to take effect, which could temporarily impact service availability. Workaround: To mitigate this issue, ensure that applications utilizing the eldap component are configured to connect only to trusted LDAP servers. Additionally, if possible, configure applications to disable or restrict the processing of LDAP referral URLs from untrusted sources, as the vulnerability requires an application to explicitly pass server-supplied referral strings to eldap for parsing. Workaround: No mitigation is currently available for this vulnerability. Red Hat recommends applying the appropriate security update as soon as it becomes available. Workaround: To mitigate this issue, restrict network access to services utilizing the `inets` HTTP server to trusted clients and networks. Alternatively, deploy a reverse proxy in front of the `inets` HTTP server and configure it to enforce body size limits for incoming requests, preventing oversized chunked bodies from reaching the vulnerable server. If a service restart or reload is required for network configuration changes to take effect, ensure proper service management procedures are followed. Workaround: To mitigate this issue, avoid configuring the `inets` httpd server's `mod_auth` module with `dets` or `mnesia` authentication backends when using multiple directory blocks that require distinct user or group populations. Alternatively, ensure that all protected directories are intended to share identical user populations, thereby eliminating reliance on namespace isolation. If possible, switch to the `plain` authentication backend, which correctly isolates per-directory users and groups.

🔗 References (12)