RHSA-2026:82939HighCVSS 8.7

Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update

Published
October 14, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (34)

CVE-2026-11856 →CVE-2026-13732 →CVE-2026-73073 →CVE-2026-86144 →CVE-2026-6368 →CVE-2026-19542 →CVE-2026-19553 →CVE-2026-86142 →CVE-2026-8924 →CVE-2026-80489 →CVE-2026-89157 →CVE-2026-89160 →CVE-2026-89161 →CVE-2026-93990 →CVE-2026-86145 →CVE-2026-89158 →CVE-2026-103111 →CVE-2026-40553 →CVE-2026-74860 →CVE-2026-84782 →CVE-2026-89156 →CVE-2026-18374 →CVE-2026-77117 →CVE-2026-86138 →CVE-2026-86140 →CVE-2026-96512 →CVE-2026-6791 →CVE-2026-19445 →CVE-2026-40467 →CVE-2026-40468 →CVE-2026-60001 →CVE-2026-66046 →CVE-2026-86143 →CVE-2026-0799 →

📋 Description

CVE-2026-0799 — libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access CVE-2026-6368 — glibc: glibc: Process abort due to invalid memory in wordexp CVE-2026-6791 — glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion CVE-2026-8924 — curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-11856 — curl: curl: Information disclosure via incorrect Digest authentication header reuse CVE-2026-13732 — gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF CVE-2026-18374 — glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string CVE-2026-19445 — python: Use-after-free of a server-side SSLContext when sni_callback switches contexts CVE-2026-19542 — glibc: Fix out-of-bounds array write in tdelete CVE-2026-19553 — python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() CVE-2026-40467 — gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c CVE-2026-40468 — gawk: gawk: Memory corruption via integer overflow CVE-2026-40553 — gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service CVE-2026-60001 — openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay CVE-2026-66046 — expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-73073 — vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-74860 — libxml2: double-free/UAF in libxml2 Python bindings CVE-2026-77117 — glibc: Non-progress DoS in SHIFT_JISX0213 -&gt CVE-2026-80489 — glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state CVE-2026-84782 — openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission CVE-2026-86138 — libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow CVE-2026-86140 — libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements CVE-2026-86142 — libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation CVE-2026-86143 — libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks CVE-2026-86144 — libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. CVE-2026-86145 — pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions CVE-2026-89156 — PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback CVE-2026-89157 — pcre2: PCRE2: Out-of-bounds write via large pattern input CVE-2026-89158 — PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms CVE-2026-89160 — pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching CVE-2026-89161 — pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match CVE-2026-93990 — expat: Expat: XML Injection via Malformed UTF-16 Input CVE-2026-96512 — sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-103111 — pcre2: pcre2: Out-of-bounds write via crafted regular expression

🎯 Affected products6

  • Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:de9de6346921c5ac663dbcd0faf13a915aaca6dbbe41ab14185af73f3da71bed_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/cds-rhel9@sha256:ce1ee2791cedd451f55dbf41487520b7911eebc7454ddd4196dcdb705def4052_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/haproxy-rhel9@sha256:481cf8c03eefc2786e320b56d726f1f33688e4d510505585d5ee0f014bad4eba_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/installer-rhel9@sha256:8e5b2f7adbb56e404e39a699b95266539ce547583ee6c9976decbaad4a35541b_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/rhua-rhel9@sha256:fa09f523d2501e42f9c78c18bd99475f562e7397ed75d8c0fc8e183bcbf4c827_amd64 as a component of Red Hat Update Infrastructure 5

✅ Remediation

The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. Workaround: Do not use trailing-dot hostnames in URLs passed to curl. Trailing dots are uncommon and incompatible with TLS SNI. Upgrade to curl 8.21.0 to resolve Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Correct usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse: ```c // req.A curl = curl_easy_init(); ... curl_easy_cleanup(curl); // req.B curl = curl_easy_init(); ... curl_easy_cleanup(curl); ``` Fixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0 Workaround: The following practices would help for avoiding exposure and mitigate this flaw: - Do not open untrusted or unknown ELF binaries in GDB without first stripping debug sections. Use `objcopy --remove-section=.stab --remove-section=.stabstr <binary>` before debugging. - Use `readelf -S <binary> | grep stab` to check for the presence of STABS sections before opening a binary in GDB. Legitimate modern binaries use DWARF, not STABS. - Consider using LLDB or other debuggers that do not support STABS for analysis of untrusted binaries. - For automated environments (CI, test farms) that invoke GDB on potentially untrusted binaries, run GDB in a sandboxed or containerized environment with restricted filesystem access. - GDB 17+ deprecates STABS support but still parses it. GDB 18 (expected late 2026/2027) will remove STABS support entirely. - GCC removed STABS emitting in GCC 13 (2023), so legitimately compiled binaries from recent GCC versions will not contain STABS data. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Restrict Python TLS servers that use SSLContext.sni_callback to trusted clients. Keep a strong reference to every SSLContext that registers an SNI callback for the lifetime of the server so the original context cannot be garbage-collected while connections remain open. Prefer wrapping the listening socket with a long-lived SSLContext; that common pattern is not affected. Host heap allocator hardening increases the difficulty of turning the use-after-free into reliable code execution but does not prevent process crashes. Workaround: This issue is reachable only through applications that use glibc's tsearch/tdelete APIs and allow construction of extremely deep trees (on the order of a million nodes). Restrict such services to trusted clients and enforce process memory limits so large tree growth is impractical. Workaround: Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped. Workaround: To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources. Workaround: Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c. Workaround: Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution. Workaround: To mitigate, avoid parsing untrusted XML where possible. Where parsing is required, restrict sources using network controls and enforce strict limits on document size, attribute counts, and request rates at the application or proxy level. Additionally, apply strict execution timeouts to cap parser cost and interrupt processes before they can exhaust CPU resources. Workaround: To mitigate this issue, users should avoid opening C source files from untrusted sources, especially when accompanied by untrusted tags files. Exercise caution when invoking C omni-completion (CTRL-X CTRL-O) on files from unknown or suspicious origins. Workaround: Do not convert untrusted input using the SHIFT_JISX0213 character set (for example via iconv). Where conversion cannot be avoided, apply process CPU time limits and container cgroup resource limits so a hung converter cannot exhaust host resources. Workaround: To mitigate this avoid converting untrusted data with that charset, or disable the conversion path if unused. Where conversion of untrusted input cannot be avoided, restrict access to trusted clients and apply process CPU/resource limits to contain hang impact. Workaround: Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries. Workaround: To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system. Workaround: To mitigate this applications should avoid passing untrusted XPointer expressions into xmlXPtrEval or XInclude xpointer= attributes and strictly cap input length well below INT_MAX. Additionally, administrators should enforce process or cgroup memory limits to prevent the construction of multi-gigabyte scheme bodies, relying on heap allocator hardening rather than standard fortify flags, which cannot stop this byte-store loop. Workaround: Cap process and cgroup memory so a process cannot build a ≥2 GiB libxml2 output backlog. Keep FORTIFY_SOURCE-built Red Hat binaries so some callback copies of the truncated length abort instead of corrupting memory Workaround: Do not expand untrusted XInclude; parse without XML_PARSE_XINCLUDE and do not call xmlXIncludeProcess / xmlXIncludeProcessTree. If XInclude is required, pass XML_PARSE_NONET (and XML_PARSE_NO_XXE where available) via xmlXIncludeProcessFlags, and restrict outbound fetches. Workaround: To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively. Workaround: To mitigate this restrict which hosts can send XML (including UTF-16) to Expat-based services with a host firewall and network segmentation. Where applications allow, prefer UTF-8-only input and reject unexpected encodings. Workaround: Append the 'Z' timezone suffix to all NOTBEFORE and NOTAFTER timestamps in sudoers rules. For example, change 'NOTAFTER=20261231235959' to 'NOTAFT…

🔗 References (39)