RHSA-2026:21275CriticalCVSS 8.2

Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update

Published
May 27, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (29)

CVE-2025-14087 →CVE-2026-4224 →CVE-2026-4519 →CVE-2026-4786 →CVE-2026-31790 →CVE-2025-13837 →CVE-2026-4878 →CVE-2026-35386 →CVE-2026-35535 →CVE-2025-6075 →CVE-2025-59375 →CVE-2026-0672 →CVE-2026-1502 →CVE-2026-6100 →CVE-2026-35387 →CVE-2025-15282 →CVE-2026-2100 →CVE-2026-29111 →CVE-2026-35385 →CVE-2026-35414 →CVE-2026-40355 →CVE-2025-14512 →CVE-2026-3644 →CVE-2026-35388 →CVE-2026-0865 →CVE-2026-2297 →CVE-2026-34982 →CVE-2026-40356 →CVE-2026-42945 →

📋 Description

CVE-2025-6075 — python: Quadratic complexity in os.path.expandvars() with user-controlled template CVE-2025-13837 — cpython: Out-of-memory when loading Plist CVE-2025-14087 — glib: GLib: Buffer underflow in GVariant parser leads to heap corruption CVE-2025-14512 — glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow CVE-2025-15282 — cpython: Header injection via newlines in data URL mediatype in Python CVE-2025-59375 — firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2026-0672 — cpython: Header injection in http.cookies.Morsel in Python CVE-2026-0865 — cpython: wsgiref.headers.Headers allows header newline injection in Python CVE-2026-1502 — python: Python: HTTP header injection via CR/LF in proxy tunnel headers CVE-2026-2100 — p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters CVE-2026-2297 — cpython: CPython: Logging Bypass in Legacy .pyc File Handling CVE-2026-3644 — cpython: Incomplete control character validation in http.cookies CVE-2026-4224 — cpython: Stack overflow parsing XML with deeply nested DTD content models CVE-2026-4519 — python: Python: Command-line option injection in webbrowser.open() via crafted URLs CVE-2026-4786 — python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API CVE-2026-4878 — libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() CVE-2026-6100 — python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules CVE-2026-29111 — systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data CVE-2026-31790 — openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key CVE-2026-34982 — vim: arbitrary command execution via modeline sandbox bypass CVE-2026-35385 — OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode CVE-2026-35386 — OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username CVE-2026-35387 — OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage CVE-2026-35388 — OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions CVE-2026-35414 — OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option CVE-2026-35535 — sudo: Sudo: Privilege escalation due to failure in privilege drop calls CVE-2026-40355 — krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism CVE-2026-40356 — krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read CVE-2026-42945 — nginx: NGINX: Arbitrary Code Execution Vulnerability

🎯 Affected products5

  • Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/cds-rhel9@sha256:29229a9b1908d9586aa60ae96ea4cab29316c058665ea4e10bd7d88e3434f38a_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/haproxy-rhel9@sha256:eeceb83a297bdb2778a63fa0e55d441ba316b77be786280746348fdcdeae866d_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/installer-rhel9@sha256:fb8d5c681efa515095f164334fde48bb2c4160069ba7512ddbf16a865c65ae17_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/rhua-rhel9@sha256:ae3724c290b6e0c536cadae4dbe38fc1241fb88520db381e04bfbd1e489989e8_amd64 as a component of Red Hat Update Infrastructure 5

✅ Remediation

The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption. Workaround: To mitigate this issue, disable the modeline support by adding the following command to the Vim configuration file: ~~~ set nomodeline ~~~ Workaround: To mitigate this issue, remove the NegoEx mechanism registration from the system's GSSAPI configuration if it is not required. This can typically be achieved by removing or commenting out the relevant entry in `/etc/gss/mech`. A restart of services utilizing Kerberos might be necessary for the changes to take effect, which could impact Kerberos-dependent functionality. Workaround: To mitigate this issue, ensure that the NegoEx mechanism is not registered in the `/etc/gss/mech` configuration file. Removing the corresponding entry from this file will prevent the vulnerable code path from being activated. This action may impact services that rely on the NegoEx GSS-API mechanism. A restart of affected Kerberos-dependent services may be required for the change to take effect.

🔗 References (34)