RHSA-2026:25138HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
June 10, 2026
Last Modified
August 17, 2026

🔗 CVE IDs covered (3)

CVE-2026-41889 →CVE-2026-45287 →CVE-2026-48702 →

📋 Description

CVE-2026-41889 — github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions CVE-2026-45287 — go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak CVE-2026-48702 — github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing

🎯 Affected products4

  • Red Hat Hardened Images
  • cosign-main@aarch64 as a component of Red Hat Hardened Images
  • cosign-main@src as a component of Red Hat Hardened Images
  • cosign-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Avoid using the non-default simple protocol in applications that use the pgx PostgreSQL driver for Go. The vulnerability is contingent on this non-default protocol and specific SQL query constructs. Configuring applications to use the default extended protocol prevents this issue. If the simple protocol is necessary, ensure that dollar-quoted string literals do not contain attacker-controlled placeholder values. Workaround: There is no effective workaround. Setting max_request_body_size reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting max_apk_metadata_size has no effect on this vulnerability since the check is applied after decompression. Upgrade to Rekor 1.5.2 or later.

🔗 References (7)