RHSA-2026:74369HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 1, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (51)

CVE-2026-93925 →CVE-2026-94636 →CVE-2026-96287 →CVE-2026-96288 →CVE-2026-96294 →CVE-2026-85086 →CVE-2026-85476 →CVE-2026-85483 →CVE-2026-85494 →CVE-2026-92834 →CVE-2026-94645 →CVE-2026-94646 →CVE-2026-94652 →CVE-2026-85088 →CVE-2026-86536 →CVE-2026-94633 →CVE-2026-96289 →CVE-2026-66054 →CVE-2026-66859 →CVE-2026-91137 →CVE-2026-94634 →CVE-2026-94635 →CVE-2026-94638 →CVE-2026-96277 →CVE-2026-82458 →CVE-2026-82459 →CVE-2026-85493 →CVE-2026-87117 →CVE-2026-94653 →CVE-2026-94656 →CVE-2026-94657 →CVE-2026-96286 →CVE-2026-66331 →CVE-2026-85087 →CVE-2026-93926 →CVE-2026-94650 →CVE-2026-94654 →CVE-2026-94658 →CVE-2026-96990 →CVE-2026-66837 →CVE-2026-66858 →CVE-2026-94648 →CVE-2026-94655 →CVE-2026-66055 →CVE-2026-66081 →CVE-2026-83745 →CVE-2026-86535 →CVE-2026-86537 →CVE-2026-90440 →CVE-2026-94644 →CVE-2026-96292 →

📋 Description

CVE-2026-66054 — thrift: thrift: Denial of Service via improper handling of compressed data CVE-2026-66055 — thrift: thrift: Denial of Service via uncontrolled resource allocation CVE-2026-66081 — thrift: thrift: Denial of Service via uninitialized pointer access in c_glib bindings CVE-2026-66331 — thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport CVE-2026-66837 — thrift: thrift: Denial of Service via buffer overflow in PHP bindings CVE-2026-66858 — thrift: Apache Thrift: Denial of Service via deeply nested unknown fields CVE-2026-66859 — thrift: thrift: Denial of Service via NULL pointer dereference in c_glib bindings CVE-2026-82458 — thrift: thrift: Denial of Service via excessive memory allocation CVE-2026-82459 — thrift: thrift: Denial of Service via integer underflow in THeaderTransport CVE-2026-83745 — thrift: thrift: Denial of Service via excessive memory allocation in WebSocket transport CVE-2026-85086 — thrift: thrift: Information disclosure via improper certificate validation in Perl bindings CVE-2026-85087 — thrift: Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op CVE-2026-85088 — thrift: thrift: Man-in-the-middle attacks via improper certificate validation CVE-2026-85476 — thrift: Apache Thrift: c_glib read_all spins when the underlying read returns 0 CVE-2026-85483 — thrift: Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end CVE-2026-85493 — thrift: Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME) CVE-2026-85494 — thrift: thrift: Denial of Service via improper message handling in language bindings CVE-2026-86535 — thrift: thrift: Denial of Service via TJSONProtocol in Node.js bindings CVE-2026-86536 — thrift: thrift: Prototype pollution in JavaScript bindings CVE-2026-86537 — thrift: thrift: Denial of Service via infinite loop in D language bindings CVE-2026-87117 — thrift: Apache Thrift: PHP thrift_protocol accelerator dereferences a missing container-element spec CVE-2026-90440 — thrift: thrift: Denial of Service via improper exception handling in TNonblockingServer CVE-2026-91137 — thrift: Apache Thrift: PHP thrift_protocol accelerator: zero-byte container elements CVE-2026-92834 — thrift: Apache Thrift: C++ WebSocket server transport does not read a full request length CVE-2026-93925 — thrift: thrift: Denial of Service via stack-based buffer overflow in THeaderProtocol CVE-2026-93926 — thrift: thrift: Denial of Service via memory leak in THeaderTransport CVE-2026-94633 — thrift: thrift: Denial of Service via excessive memory allocation in Dart bindings CVE-2026-94634 — thrift: Apache Thrift: Python TJSONProtocol has a string length limit that is off by default CVE-2026-94635 — thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings CVE-2026-94636 — thrift: Apache Thrift: Python TZlibTransport stops enforcing its decompressed-size limit once the limit is exactly used up CVE-2026-94638 — thrift: Apache Thrift: Denial of Service via uncontrolled resource allocation in PHP bindings CVE-2026-94644 — apache/thrift: thrift: Apache Thrift: PHP TJSONProtocol string/number readers have no size bound CVE-2026-94645 — thrift: Apache Thrift: Node.js TJSONProtocol uses a peer-declared container size as an unbounded loop bound CVE-2026-94646 — thrift: thrift: Denial of Service via prototype pollution in Node.js bindings CVE-2026-94648 — thrift: Apache Thrift: dart TJsonProtocol/TJSONProtocol has no string size bound CVE-2026-94650 — thrift: thrift: Denial of Service via uncontrolled recursion in C GLib bindings CVE-2026-94652 — thrift: thrift: Denial of Service via memory leak in C++ bindings CVE-2026-94653 — thrift: Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic) CVE-2026-94654 — thrift: thrift: Denial of Service via infinite loop in Python bindings CVE-2026-94655 — thrift: Apache Thrift: Lua TJsonProtocol string/number readers have no size bound and are quadratic CVE-2026-94656 — thrift: Apache Thrift: rb TJsonProtocol/TJSONProtocol has no string size bound CVE-2026-94657 — thrift: thrift: Denial of Service via improper resource allocation in JavaME bindings CVE-2026-94658 — thrift: thrift: Denial of Service via inefficient algorithmic complexity in Lua bindings CVE-2026-96277 — thrift: thrift: Denial of Service via uncaught exception in Ruby bindings CVE-2026-96286 — thrift: Apache Thrift: Perl servers end serve() when serving one connection fails CVE-2026-96287 — thrift: Apache Thrift: Perl FramedTransport reads and TLS socket writes re-slice the remaining buffer on every call (quadratic) CVE-2026-96288 — thrift: Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory) CVE-2026-96289 — thrift: Apache Thrift: php --gen php:inlined struct readers (and TProtocol::skipBinary) have no recursion-depth guard CVE-2026-96292 — thrift: thrift: Denial of Service via inefficient regular expression evaluation in Lua bindings CVE-2026-96294 — thrift: Apache Thrift: nodejs web server: no error listener on an upgraded WebSocket connection CVE-2026-96990 — thrift: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound

🎯 Affected products14

  • Red Hat Hardened Images
  • perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • python3-thrift-0:0.25.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3-thrift-0:0.25.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • thrift-0:0.25.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • thrift-0:0.25.0-0.1.hum1@src as a component of Red Hat Hardened Images
  • thrift-0:0.25.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • thrift-devel-0:0.25.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • thrift-devel-0:0.25.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • thrift-glib-0:0.25.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • thrift-glib-0:0.25.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • thrift-qt-0:0.25.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • thrift-qt-0:0.25.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Restrict network reachability to services exposing Apache Thrift WebSocket transports by limiting access to trusted IP addresses or binding exclusively to the loopback interface. 1. If remote access is not required, configure the application to listen only on localhost (127.0.0.1). 2. To restrict exposure using firewalld, remove the service port from public zones and allow access only from trusted IP subnets: firewall-cmd --permanent --zone=public --remove-port=<PORT>/tcp firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR> firewall-cmd --permanent --zone=trusted --add-port=<PORT>/tcp firewall-cmd --reload Caveat: Restricting network access prevents legitimate clients outside of the trusted subnet from connecting to the service. Warning: Executing 'firewall-cmd --reload' applies configuration changes immediately and may disrupt active network connections. Workaround: Restrict network exposure by limiting access to Apache Thrift service ports to localhost or trusted internal networks. Using firewalld, access can be restricted by binding the listening port only to trusted source addresses: ``` firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_CIDR> firewall-cmd --permanent --zone=public --remove-port=<PORT>/tcp firewall-cmd --reload ``` Replace `<TRUSTED_CIDR>` with your authorized network subnet and `<PORT>` with the port used by the Thrift server application. Warning: Reloading firewalld configuration applies changes immediately and may drop existing network connections. Ensure management access is preserved before altering firewall zones. Caveats: Restricting network reachability prevents external or untrusted clients from communicating with the Thrift service, which may impact applications that require broader network access. Workaround: Restrict network exposure by limiting access to applications utilizing Apache Thrift Lua bindings to trusted network segments or binding listening services strictly to localhost (127.0.0.1). To restrict network access to the port utilized by the Thrift service using firewalld: 1. Remove public exposure of the service port: # firewall-cmd --permanent --remove-port=<PORT>/tcp 2. Restrict communication to a trusted IP subnet: # firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_CIDR> 3. Reload firewalld to apply the changes: # firewall-cmd --reload Warning: Reloading the firewall configuration may temporarily interrupt active connections. Blocking this port will prevent any unauthorized or untrusted remote clients from communicating with the service. Additionally, avoid deploying or running services that implement Apache Thrift via its Lua bindings if not strictly required by your workloads.

🔗 References (55)