RHSA-2026:63151HighCVSS 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
September 3, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (2)

CVE-2026-59944 →CVE-2026-84361 →

📋 Description

CVE-2026-59944 — composer: Composer: Security bypass allows execution of unauthorized binaries via symlinked paths CVE-2026-84361 — composer: Composer: Arbitrary code execution via malicious Perforce source URL

🎯 Affected products4

  • Red Hat Hardened Images
  • composer-0:2.10.3-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • composer-0:2.10.3-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • composer-0:2.10.3-1.hum1@src as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Ensure the integrity of Composer's `vendor` directory and associated metadata. Avoid restoring `vendor` directories from untrusted caches or allowing lower-trust processes to modify them. Implement strict access controls on Composer project directories and perform Composer operations in a trusted, isolated build environment to prevent the introduction of malicious symlinks or metadata. This operational control may require adjustments to existing CI/CD pipelines or build processes. Workaround: To mitigate this issue, avoid installing the Perforce `p4` client on systems where Composer is used, unless explicitly required. Additionally, ensure that Composer only processes dependencies from trusted repositories and `composer.lock` files to prevent the introduction of malicious `source.url` values.

🔗 References (6)