RHSA-2026:32963HighCVSS 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
June 29, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (4)

CVE-2026-47262 →CVE-2026-53489 →CVE-2026-53492 →CVE-2026-44740 →

📋 Description

CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-47262 — github.com/containerd/containerd: containerd: Denial of Service via maliciously crafted image leading to unbounded group parsing CVE-2026-53489 — github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore CVE-2026-53492 — github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.

🎯 Affected products4

  • Red Hat Hardened Images
  • grype-main@aarch64 as a component of Red Hat Hardened Images
  • grype-main@src as a component of Red Hat Hardened Images
  • grype-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+ Workaround: No mitigation is needed for Red Hat products. The vulnerable code path in containerd's CRI plugin group-parsing logic is not executed because Red Hat uses CRI-O as the container runtime. Products that bundle containerd as a library dependency for OCI image operations are not affected. Workaround: For Red Hat OpenShift and layered products, CRI-O is the supported container runtime, so the vulnerable containerd CRI checkpoint-restore code path is not exercised during normal cluster operation. Customers should nevertheless apply Red Hat product errata as they become available to receive updates for affected operator, must-gather and tooling images that may bundle the containerd Go module. If containerd is deployed as the container runtime with CRI checkpoint/restore enabled, disable checkpoint/restore functionality until a fixed version of containerd can be applied.

🔗 References (8)