RHSA-2026:22934HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
June 3, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (6)

CVE-2026-44432 →CVE-2026-45149 →CVE-2026-6734 →CVE-2026-9358 →CVE-2026-9675 →CVE-2026-9697 →

📋 Description

CVE-2026-6734 — undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing CVE-2026-9358 — postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization CVE-2026-9675 — undici: undici WebSocket client vulnerable to denial of service via cumulative fragment bypass CVE-2026-9697 — undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy CVE-2026-44432 — urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-45149 — brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges

🎯 Affected products5

  • Red Hat Hardened Images
  • rust-main@aarch64 as a component of Red Hat Hardened Images
  • rust-main@noarch as a component of Red Hat Hardened Images
  • rust-main@src as a component of Red Hat Hardened Images
  • rust-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: The single most impactful mitigation is applying network egress controls to restrict which external destinations affected applications can reach. Because the vulnerability causes requests to be misrouted to wrong origins, limiting the set of reachable origins directly reduces the attack surface. These controls collectively limit the blast radius of the connection pool misrouting — the attacker must compromise one of the explicitly allowed destinations rather than any arbitrary origin — but they do not fix the underlying logic bug. Workaround: Upgrade to PostCSS 8.5.6 or later. As a workaround, validate and sanitize CSS input before processing with PostCSS to prevent deeply nested or malicious structures from reaching the serializer. Workaround: Red Hat products that bundle the undici HTTP client ship versions 5.x, 6.x, and 7.x, which do not contain the vulnerable WebSocket frame accumulation code path introduced in undici 8.0.0. No Red Hat product streams are affected by this vulnerability. Users who have manually installed undici 8.x outside of Red Hat-provided packages should upgrade to undici 8.5.0 or later to fully resolve this issue. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (11)