RHSA-2026:2925HighCVSS 7.5

Red Hat Security Advisory: RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release

Published
February 18, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (5)

CVE-2025-66471 →CVE-2026-21441 →CVE-2026-24049 →CVE-2025-64756 →CVE-2025-66418 →

📋 Description

CVE-2025-64756 — glob: glob: Command Injection Vulnerability via Malicious Filenames CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking

🎯 Affected products2

  • Red Hat Trusted Artifact Signer 1.2
  • registry.redhat.io/rhtas/segment-reporting-rhel9@sha256:433385e5a9d3524baea007bf67ea785b2ee76b8218debf21fedf935950ab284e_amd64 as a component of Red Hat Trusted Artifact Signer 1.2

✅ Remediation

Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2/html-single/release_notes/index Workaround: To mitigate this issue, avoid using the `glob` command-line interface with the `-c` or `--cmd` option when processing filenames from untrusted sources. If programmatic use of `glob` is necessary, ensure that filenames are thoroughly sanitized before being passed to commands executed with shell interpretation enabled. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (10)