RHSA-2026:24479HighCVSS 8.3

Red Hat Security Advisory: RHTAS 1.3.5 - Red Hat Trusted Artifact Signer Release

Published
June 8, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (3)

CVE-2026-34986 →CVE-2026-33815 →CVE-2026-33816 →

📋 Description

CVE-2026-33815 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-33816 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products11

  • Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:2c9bd92ff3dd932803de061270880d8179f32b7c1217dbc8606d973c7552edcd_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/fulcio-rhel9@sha256:2f54bd911d6cdf28b8d12ded1ba959ed6684274f2f4130797f1c4048296ee534_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:bf6562233da1cdef3dc7055a7323dcae9fcf336b83ace2f2cd8d9f8452514e34_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:afe0725860b057f232222c5b7c7e8a3cbf72280dc348a12f0db75532ba368d07_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/rekor-server-rhel9@sha256:adcbc7f0f6eca7c6c7fe8ca9493648e117665892bc6df00d6cae4e784126fc32_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:fd87501a0f3f32b32e348519c89d1421aead104d79cf05eff4cb12cf47cb34bf_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/trillian-database-rhel9@sha256:6eea8b149271d047973a32a6e82a52927119a9ba9786f5f915dc7a3a2c40d162_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:07ffa47b91d8966433d437daaa74d4a93a97fcfd0791b95d46ba2001091eaf0b_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:c3f3d964aaa59be902f4c303a0d7b30bc9fa16afba74be3209c5084d06105c5b_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:f36eea94c52e358f4470211dd113d6a4a465dc389929dcd538b4e111c96092f9_amd64 as a component of Red Hat Trusted Artifact Signer 1.3

✅ Remediation

Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (8)