RHSA-2026:22634HighCVSS 8.2

Red Hat Security Advisory: Insights proxy Container Image

Published
June 2, 2026
Last Modified
September 17, 2026

🔗 CVE IDs covered (13)

CVE-2026-34982 →CVE-2026-40356 →CVE-2025-14512 →CVE-2026-4046 →CVE-2026-4437 →CVE-2026-4438 →CVE-2026-4878 →CVE-2026-28390 →CVE-2026-29111 →CVE-2026-40355 →CVE-2025-14087 →CVE-2026-2100 →CVE-2026-31790 →

📋 Description

CVE-2025-14087 — glib: GLib: Buffer underflow in GVariant parser leads to heap corruption CVE-2025-14512 — glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow CVE-2026-2100 — p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters CVE-2026-4046 — glibc: glibc: Denial of Service via iconv() function with specific character sets CVE-2026-4437 — glibc: glibc: Incorrect DNS response parsing via crafted DNS server response CVE-2026-4438 — glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions CVE-2026-4878 — libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() CVE-2026-28390 — openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing CVE-2026-29111 — systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data CVE-2026-31790 — openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key CVE-2026-34982 — vim: arbitrary command execution via modeline sandbox bypass CVE-2026-40355 — krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism CVE-2026-40356 — krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read

🎯 Affected products3

  • Red Hat Insights proxy 1.5
  • registry.redhat.io/insights-proxy/insights-proxy-container-rhel9@sha256:35a26e08219c8608fd6be94ab0e16947c6d8dd68752b7c7747b65f23f1679492_amd64 as a component of Red Hat Insights proxy 1.5
  • registry.redhat.io/insights-proxy/insights-proxy-container-rhel9@sha256:97b534defdc32202c8208b1ab1411a1e1085accaa79372437d467968fae0ba53_arm64 as a component of Red Hat Insights proxy 1.5

✅ Remediation

The Insights proxy container image provided here is downloaded by the Red Hat Insights proxy product RPM. Before applying this update, make sure all previously released errata relevant to your system have been applied. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Applications that process Cryptographic Message Syntax (CMS) EnvelopedData messages should be configured to only accept input from trusted sources. Restricting network access to services that process untrusted CMS data can also reduce exposure to this Denial of Service vulnerability. Workaround: To mitigate this issue, disable the modeline support by adding the following command to the Vim configuration file: ~~~ set nomodeline ~~~ Workaround: To mitigate this issue, remove the NegoEx mechanism registration from the system's GSSAPI configuration if it is not required. This can typically be achieved by removing or commenting out the relevant entry in `/etc/gss/mech`. A restart of services utilizing Kerberos might be necessary for the changes to take effect, which could impact Kerberos-dependent functionality. Workaround: To mitigate this issue, ensure that the NegoEx mechanism is not registered in the `/etc/gss/mech` configuration file. Removing the corresponding entry from this file will prevent the vulnerable code path from being activated. This action may impact services that rely on the NegoEx GSS-API mechanism. A restart of affected Kerberos-dependent services may be required for the change to take effect.

🔗 References (16)