RHSA-2026:55543HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
August 17, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (4)

CVE-2026-54876 →CVE-2026-69247 →CVE-2026-69248 →CVE-2026-69249 →

📋 Description

CVE-2026-54876 — openssl: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking CVE-2026-69247 — python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing CVE-2026-69248 — python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees CVE-2026-69249 — python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

🎯 Affected products4

  • Red Hat Hardened Images
  • python-cryptography-main@aarch64 as a component of Red Hat Hardened Images
  • python-cryptography-main@src as a component of Red Hat Hardened Images
  • python-cryptography-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: The vulnerable APIs were introduced in cryptography 44.0.0 and fixed in 50.0.0. Workaround: The Rust PolicyBuilder verifier was introduced in cryptography 42.0.0 and this issue was fixed in 49.0.0. Workaround: The Rust PolicyBuilder verifier was introduced in cryptography 42.0.0 and this issue was fixed in 49.0.0 (signature-check budget of 128).

🔗 References (9)