Red Hat Security Advisory: Satellite 6.19.2 Async Update

CVE-2026-5135 — foreman: Foreman: Unauthorized modification of host configurations via broken access control CVE-2026-5136 — foreman: Foreman: Privilege escalation to administrator-level access via usergroup role assignment manipulation CVE-2026-5138 — foreman: Foreman: Information disclosure via improper validation of nested request parameters CVE-2026-5142 — foreman: foreman: Cross-tenant private SSH key disclosure via taxonomy scoping bypass CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27727 — com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-40192 — Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing CVE-2026-48526 — python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens