RHSA-2026:11768HighCVSS 8.1

Red Hat Security Advisory: Red Hat Update Infrastructure 5.2 Technology Preview security update

Published
April 29, 2026
Last Modified
August 13, 2026

🔗 CVE IDs covered (9)

CVE-2026-6100 →CVE-2026-25679 →CVE-2026-28417 →CVE-2026-33412 →CVE-2026-4424 →CVE-2026-5121 →CVE-2026-27135 →CVE-2026-28421 →CVE-2026-4786 →

📋 Description

CVE-2026-4424 — libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing CVE-2026-4786 — python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API CVE-2026-5121 — libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing CVE-2026-6100 — python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27135 — nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination CVE-2026-28417 — vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin CVE-2026-28421 — vim: Vim: Denial of service and information disclosure via crafted swap file CVE-2026-33412 — vim: Vim: Arbitrary code execution via command injection in glob() function

🎯 Affected products4

  • Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9@sha256:9c099abe9fe9f06816a9ddd95c8123bd2909e66aa31b05ce5a143495efedd274_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/installer-tp-rhel9@sha256:9827772c3fffde2b94ac6758eb146209973bb09bd86980e02cd0cafa66f4aa3e_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/rhua-tp-rhel9@sha256:1debabb74204bd06904737367b77cb42ab5d69e73da5c051e74e8dbc7e6719fa_amd64 as a component of Red Hat Update Infrastructure 5

✅ Remediation

Please consult the RHUI Technology Preview Release Notes at https://access.redhat.com/articles/7141172 for instructions on how to use this image set. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, avoid processing untrusted ISO9660 images with applications that utilize `libarchive`. Users should only extract or read content from ISO images obtained from trusted sources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (15)