RHSA-2026:15862CriticalCVSS 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
May 9, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (5)

CVE-2026-45287 →CVE-2026-53489 →CVE-2026-53492 →CVE-2026-40898 →CVE-2026-44432 →

📋 Description

CVE-2026-40898 — github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers CVE-2026-44432 — urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-45287 — go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak CVE-2026-53489 — github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore CVE-2026-53492 — github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.

🎯 Affected products4

  • Red Hat Hardened Images
  • trivy-main@aarch64 as a component of Red Hat Hardened Images
  • trivy-main@src as a component of Red Hat Hardened Images
  • trivy-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: For Red Hat OpenShift and layered products, CRI-O is the supported container runtime, so the vulnerable containerd CRI checkpoint-restore code path is not exercised during normal cluster operation. Customers should nevertheless apply Red Hat product errata as they become available to receive updates for affected operator, must-gather and tooling images that may bundle the containerd Go module. If containerd is deployed as the container runtime with CRI checkpoint/restore enabled, disable checkpoint/restore functionality until a fixed version of containerd can be applied.

🔗 References (9)