RHSA-2026:74162HighCVSS 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
September 30, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (13)

CVE-2026-75806 →CVE-2026-77696 →CVE-2026-35189 →CVE-2026-54872 →CVE-2026-75804 →CVE-2026-75805 →CVE-2026-84782 →CVE-2026-84784 →CVE-2026-35191 →CVE-2026-42772 →CVE-2026-54873 →CVE-2026-54875 →CVE-2026-72897 →

📋 Description

CVE-2026-35189 — openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing CVE-2026-35191 — openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting CVE-2026-42772 — openssl: openssl: Denial of Service via inefficient QUIC stream reassembly CVE-2026-54872 — openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations CVE-2026-54873 — openssl: openssl: Denial of Service via excessive QUIC packet buffer retention CVE-2026-54875 — openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V CVE-2026-72897 — openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch CVE-2026-75804 — openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control CVE-2026-75805 — openssl: openssl: Denial of Service via crafted CMP certificate revocation response CVE-2026-75806 — openssl: OpenSSL: Denial of Service via undersized DTLS record CVE-2026-77696 — openssl: OpenSSL: Private key recovery via SM2 timing side-channel CVE-2026-84782 — openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission CVE-2026-84784 — openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog

🎯 Affected products16

  • Red Hat Hardened Images
  • openssl-1:3.5.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-1:3.5.9-0.1.hum1@src as a component of Red Hat Hardened Images
  • openssl-1:3.5.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-config-fips-1:3.5.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-config-fips-1:3.5.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-devel-1:3.5.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-devel-1:3.5.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-devel-engine-1:3.5.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-devel-engine-1:3.5.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-fips-provider-upstream-1:3.5.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-fips-provider-upstream-1:3.5.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-libs-1:3.5.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-libs-1:3.5.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-perl-1:3.5.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-perl-1:3.5.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Limit acceptance of untrusted peer certificates and keep certificate size/chain limits conservative in TLS services. Prefer not enabling client-certificate authentication unless required. Workaround: If QUIC is not required, disable it in the application or proxy. Prefer leaving QUIC address validation enabled (OpenSSL default). Restrict untrusted UDP/QUIC peers. Workaround: If QUIC is not required, disable it in the application or reverse proxy. Restrict untrusted QUIC/UDP peers able to complete a handshake. Workaround: Prefer NIST curves with dedicated constant-time implementations (P-256, P-384, P-521) for ECDSA. Avoid Brainpool and other generic prime curves for high-value signing where practical. Workaround: If QUIC is not required, disable it in the application or reverse proxy. Restrict untrusted QUIC peers and apply process memory limits where appropriate. Workaround: If SM2 is not required, disable or avoid SM2 keys/algorithms in the application configuration. On aarch64/riscv64 hosts that must use SM2, restrict local access to processes performing SM2 private-key operations. Workaround: Avoid calling SSL_set_SSL_CTX() during an active handshake unless required (for example SNI virtual hosts). Ensure original and replacement SSL_CTX instances are created with consistent provider/signature-algorithm configuration. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Do not revoke certificates over CMP by supplying a PKCS#10 CSR (`openssl cmp -cmd rr -csr ...` or `OSSL_CMP_CTX_set1_p10CSR()`). Identify the certificate by certificate or by issuer name and serial number instead. Restrict CMP clients to trusted CMP servers and protect CMP message-protection credentials. If CMP certificate revocation is unused, avoid enabling CMP client revocation workflows. Workaround: If DTLS is not required, disable DTLS listeners and prefer TLS over reliable transports. Restrict untrusted DTLS/UDP peers at the network edge. Workaround: If SM2 is not required, disable or avoid SM2 signing in application configuration. Where SM2 must be used, restrict who can solicit large numbers of signatures. Workaround: If QUIC is not required, disable it in the application or reverse proxy. Restrict untrusted QUIC/UDP peers that can complete or attempt a handshake.

🔗 References (17)