RHSA-2026:92859HighCVSS 8.2

Red Hat Security Advisory: Satellite 6.17 security update

Published
October 29, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (17)

CVE-2026-18660 →CVE-2026-63072 →CVE-2026-78667 →CVE-2026-84445 →CVE-2026-89425 →CVE-2026-97031 →CVE-2026-8924 →CVE-2026-19203 →CVE-2026-68497 →CVE-2026-89407 →CVE-2026-56852 →CVE-2026-59646 →CVE-2026-63076 →CVE-2026-68494 →CVE-2026-78669 →CVE-2026-111943 →CVE-2026-94440 →

📋 Description

CVE-2026-8924 — curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-18660 — org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering CVE-2026-19203 — org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-59646 — org.bouncycastle/bc-java: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation CVE-2026-63072 — openssl: heap buffer overflow in CMS key unwrapping CVE-2026-63076 — openssl: invalid pointer dereference in CMP server via crafted protectionAlg CVE-2026-68494 — com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser CVE-2026-68497 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing CVE-2026-78667 — net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-89407 — com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89425 — com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing CVE-2026-94440 — net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing CVE-2026-97031 — crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products7

  • Red Hat Satellite 6.17 for RHEL 9
  • openvox-agent-0:8.31.1-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • openvox-agent-0:8.31.1-1.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9
  • openvox-server-0:8.17.0-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9
  • openvox-server-0:8.17.0-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9
  • yggdrasil-worker-forwarder-0:0.1.1-1.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Do not use trailing-dot hostnames in URLs passed to curl. Trailing dots are uncommon and incompatible with TLS SNI. Upgrade to curl 8.21.0 to resolve Workaround: There is no mitigation for this issue other than applying the fix. As a temporary workaround, administrators who rely on Jetty host allow/deny filtering should add case-variant duplicates of every configured hostname to the filter lists, or enforce hostname case-normalization at an upstream load balancer or reverse proxy, until the update is installed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Upgrade com.fasterxml.jackson.core:jackson-core to a fixed version, such as 2.18.8 or later, 2.21.4 or later, or the first fixed release in the applicable 2.22.x stream. For Jackson 3.x, upgrade to 3.1.4 or later, or the first fixed release in the applicable 3.2.x stream. If upgrading is not immediately possible, do not expose the non-blocking parser to untrusted, incrementally streamed JSON. Where feasible, use a synchronous parser or buffer and enforce strict request-size, connection-timeout, and concurrency limits at the ingress layer. Apply the upgrade as soon as possible because ingress limits reduce exposure but do not correct the parser defect. Workaround: Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity. Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (20)