RHSA-2026:19410HighCVSS 9.1

Red Hat Security Advisory: MTV RHEL9 Images

Published
May 19, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (8)

CVE-2026-4601 →CVE-2026-4602 →CVE-2026-4800 →CVE-2026-4926 →CVE-2026-29063 →CVE-2026-4598 →CVE-2026-4599 →CVE-2026-4600 →

📋 Description

CVE-2026-4598 — jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs CVE-2026-4599 — jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces CVE-2026-4600 — jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters CVE-2026-4601 — jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing CVE-2026-4602 — jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-4926 — path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution

🎯 Affected products13

  • Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:0527cc4671d34b889c2fb445ca7367d0ab7957339f04faf0713fe5401f1077f0_amd64 as a component of Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:ac92e8f85699adfd5517fa9bbeb34833a4f9f9b0ccbfa3a55c0d9822976dadfc_amd64 as a component of Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:6a604eac533bd45c81b631546f00ae2a9574f48609877613618fe4605e429e63_amd64 as a component of Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:d6bb7aafcf2042b2c532a6875e542aa0a42206c281ff3178192d97bd0ae53f35_amd64 as a component of Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:4751132b81132aabc153e1a4f9e4452e350fa808af5a50b96635b29c71835ee8_amd64 as a component of Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:c831f034ec79b69483d63f06c4f79cd322fb07a27441f3107252f9cddd78b3a2_amd64 as a component of Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:e2002c7ee74f3d169e37e96dd146b588f73aa33a46945935eee981b3de95d940_amd64 as a component of Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1ce52e7ec6b1100ccdac22ff7045842a01cdc1ea35c0874caf159967a369c44e_amd64 as a component of Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:43f7f914e202c153764aa3985271d99b7eb36c3f9e4958eb4f9e07c30e514402_amd64 as a component of Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:86613257836094ebbbd90c8fafc02dc723fe2d5d44d1bc17860e25e30d008e19_amd64 as a component of Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fb430b54eb99c71a9e12f2f681b73b5f225755c0de731c397dc87fb27afdd59_amd64 as a component of Migration Toolkit for Virtualization 2.9
  • registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:e3a1e8ceea8e42441287cc13cd58eb662624049317812d8f059b6d188757d319_amd64 as a component of Migration Toolkit for Virtualization 2.9

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.9/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions.

🔗 References (12)