RHSA-2026:30649MediumCVSS 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
June 28, 2026
Last Modified
October 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-9150 →

📋 Description

CVE-2026-9150 — libsolv: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums

🎯 Affected products18

  • Red Hat Hardened Images
  • libsolv-0:0.7.39-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • libsolv-0:0.7.39-3.hum1@src as a component of Red Hat Hardened Images
  • libsolv-0:0.7.39-3.hum1@x86_64 as a component of Red Hat Hardened Images
  • libsolv-demo-0:0.7.39-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • libsolv-demo-0:0.7.39-3.hum1@x86_64 as a component of Red Hat Hardened Images
  • libsolv-devel-0:0.7.39-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • libsolv-devel-0:0.7.39-3.hum1@x86_64 as a component of Red Hat Hardened Images
  • libsolv-tools-0:0.7.39-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • libsolv-tools-0:0.7.39-3.hum1@x86_64 as a component of Red Hat Hardened Images
  • libsolv-tools-base-0:0.7.39-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • libsolv-tools-base-0:0.7.39-3.hum1@x86_64 as a component of Red Hat Hardened Images
  • perl-solv-0:0.7.39-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • perl-solv-0:0.7.39-3.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3-solv-0:0.7.39-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3-solv-0:0.7.39-3.hum1@x86_64 as a component of Red Hat Hardened Images
  • ruby-solv-0:0.7.39-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • ruby-solv-0:0.7.39-3.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, ensure that libsolv only processes trusted and cryptographically signed Debian repository metadata. Avoid ingesting or processing `Packages` files from untrusted or unverified sources.

🔗 References (5)