RHSA-2026:28573HighCVSS 8.1

Red Hat Security Advisory: Red Hat Offline Knowledge Portal security and content update

Published
June 23, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (5)

CVE-2026-5795 →CVE-2026-44249 →CVE-2026-45292 →CVE-2026-45416 →CVE-2026-50010 →

📋 Description

CVE-2026-5795 — org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables CVE-2026-44249 — netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation CVE-2026-45292 — opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage CVE-2026-45416 — netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake CVE-2026-50010 — netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

🎯 Affected products3

  • Red Hat Offline Knowledge Portal 1.2.11
  • registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:9620b543dab8aa6e7a2f372890512c885c4beb6098d61fc5dd68e15cb0e2cc22_arm64 as a component of Red Hat Offline Knowledge Portal 1.2.11
  • registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:c0b2c8c0cf4ff8340aef1ce4e92fbf0dee4fc0b88a0c17659ad018f2fc21513a_amd64 as a component of Red Hat Offline Knowledge Portal 1.2.11

✅ Remediation

The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, configure applications utilizing Netty's `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application's documentation for details on configuring Netty's TLS handler. A restart of the affected application or service is required for the configuration changes to take effect.

🔗 References (10)