RHSA-2026:19409HighCVSS 9.1

Red Hat Security Advisory: MTV RHEL9 Images

Published
May 19, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (8)

CVE-2026-4601 →CVE-2026-4602 →CVE-2026-4800 →CVE-2026-4926 →CVE-2026-29063 →CVE-2026-4598 →CVE-2026-4599 →CVE-2026-4600 →

📋 Description

CVE-2026-4598 — jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs CVE-2026-4599 — jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces CVE-2026-4600 — jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters CVE-2026-4601 — jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing CVE-2026-4602 — jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-4926 — path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution

🎯 Affected products15

  • Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:6f5668c03224d4f155b7716769beecb5c62c6bbc73f345c609cfb6ad8cecfd12_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:d4cdfd9517043829ef07291e0528298dadbc5aad8a594bf8c5f1551ce3414c65_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:0b1a46357b43429aa2729b7caa728969a0d2cf306f56cbf3607acb78ac95b099_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:52fa50a129931342cbe48abde9d6f8f09e469d398ca38ffad86a8107fb6b4182_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f0b40a5449ded48b70d5cc57481dfabce902fc55c85e4630768ce7224cab82cb_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:a301b442ab9f368f7a75cb17c46d78b6b42fa129ef94ede7618617428975e346_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:cfe5b7d9a9acb7de50058b0f30a702aeca8dedfeb0438dd9fe68a24209d1359a_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e740dda4aed4d9c185b59e12e979340046710d4a6c6ed24f555775fc976bc5fb_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:8416a0add1f5452dd321a1f5a8e25385424930cb3fee5c730c26da11af1e6fab_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:948f2c1ee5bfa3fa1f5b54a9534c052bea5f69034b19d08f2207583ca504e7b0_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:5bdf3a055bdf4e15cb92eaad696618cc182058abb96d7cd9ce18f7886dcfba94_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:a764287467d44c19cb8163600c4ef20b094010ec397dc9f4aa59bb56da874bcb_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:55c49e4a697a68baa20cbe13fe5d00cd9d8059b837018f86aa45772ca9b1cc79_amd64 as a component of Migration Toolkit for Virtualization 2.1
  • registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:c9bf774ff543566106f1f98a98936412690eaa865899e494356afd29b44616dd_amd64 as a component of Migration Toolkit for Virtualization 2.1

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions.

🔗 References (12)