RHSA-2026:21773HighCVSS 7.4

Red Hat Security Advisory: Red Hat Offline Knowledge Portal security and content update

Published
May 28, 2026
Last Modified
September 4, 2026

🔗 CVE IDs covered (7)

CVE-2026-34481 →CVE-2025-11143 →CVE-2026-2332 →CVE-2026-34477 →CVE-2026-34478 →CVE-2026-34479 →CVE-2026-34480 →

📋 Description

CVE-2025-11143 — org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing CVE-2026-2332 — org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing CVE-2026-34477 — org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification CVE-2026-34478 — org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames CVE-2026-34479 — org.apache.logging.log4j/log4j-1.2-api: Apache Log4j 1-to-Log4j 2 bridge: Log processing denial of service due to improper XML escaping CVE-2026-34480 — org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging CVE-2026-34481 — org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output

🎯 Affected products3

  • Red Hat Offline Knowledge Portal 1.2.6
  • registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64 as a component of Red Hat Offline Knowledge Portal 1.2.6
  • registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64 as a component of Red Hat Offline Knowledge Portal 1.2.6

✅ Remediation

The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (12)