RHSA-2026:34119HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
July 1, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (4)

CVE-2026-49476 →CVE-2026-49477 →CVE-2026-44431 →CVE-2026-45409 →

📋 Description

CVE-2026-44431 — urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers CVE-2026-45409 — python-idna: idna: Denial of Service via specially crafted long inputs CVE-2026-49476 — python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string CVE-2026-49477 — soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings

🎯 Affected products4

  • Red Hat Hardened Images
  • python-rpds-py-main@aarch64 as a component of Red Hat Hardened Images
  • python-rpds-py-main@src as a component of Red Hat Hardened Images
  • python-rpds-py-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this denial-of-service vulnerability, applications utilizing the `idna` Python library should implement input validation to ensure that domain names do not exceed the standard 253-character length limit before being passed to the `idna.encode()` function. This operational control prevents the processing of excessively long inputs that could lead to resource exhaustion and service unavailability. Applications that pass user-controlled data directly to `idna.encode()` without validation checks (e.g.: DNS length < 254 chars) are affected. Workaround: There is no mitigation for this flaw other than updating the soupsieve package when upstream patches are available. The impact is limited to availability (denial of service) — an attacker cannot access or modify data through this vulnerability. Applications that do not process untrusted CSS selector strings are at reduced risk.

🔗 References (8)