RHSA-2026:10999HighCVSS 7.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
April 27, 2026
Last Modified
September 6, 2026

🔗 CVE IDs covered (3)

CVE-2026-44028 →CVE-2026-44029 →CVE-2026-47423 →

📋 Description

CVE-2026-44028 — nix: coroutine stack-to-heap overflow via unbounded recursion in NAR directory parser CVE-2026-44029 — nix: absolute path traversal when unpacking archives to disk CVE-2026-47423 — dompurify: DOMPurify: Cross-site scripting vulnerability allows information disclosure

🎯 Affected products5

  • Red Hat Hardened Images
  • ruff-main@aarch64 as a component of Red Hat Hardened Images
  • ruff-main@noarch as a component of Red Hat Hardened Images
  • ruff-main@src as a component of Red Hat Hardened Images
  • ruff-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: There is no direct mitigation for this flaw other than updating the DOMPurify library when upstream patches are available. As a defense-in-depth measure, Content Security Policy (CSP) headers that restrict inline script execution can help reduce the impact of XSS vulnerabilities. This issue is fixed in version 3.4.5.

🔗 References (7)