RHSA-2026:5606HighCVSS 8.1

Red Hat Security Advisory: Red Hat Ceph Storage

Published
March 24, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (14)

CVE-2026-0865 →CVE-2026-0915 →CVE-2025-15367 →CVE-2026-1299 →CVE-2026-22695 →CVE-2026-22801 →CVE-2026-23490 →CVE-2026-25646 →CVE-2025-9820 →CVE-2025-12801 →CVE-2025-14831 →CVE-2025-15281 →CVE-2025-15366 →CVE-2026-0861 →

📋 Description

CVE-2025-9820 — gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function CVE-2025-12801 — nfs-utils: rpc.mountd in the nfs-utils privilege escalation CVE-2025-14831 — gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification CVE-2025-15281 — glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory CVE-2025-15366 — cpython: IMAP command injection in user-controlled commands CVE-2025-15367 — cpython: POP3 command injection in user-controlled commands CVE-2026-0861 — glibc: Integer overflow in memalign leads to heap corruption CVE-2026-0865 — cpython: wsgiref.headers.Headers allows header newline injection in Python CVE-2026-0915 — glibc: glibc: Information disclosure via zero-valued network query CVE-2026-1299 — cpython: email header injection due to unquoted newlines CVE-2026-22695 — libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read CVE-2026-22801 — libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API CVE-2026-23490 — pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID CVE-2026-25646 — libpng: LIBPNG has a heap buffer overflow in png_set_quantize

🎯 Affected products5

  • Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64le as a component of Red Hat Ceph Storage 8

✅ Remediation

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Applying the upstream patch or vendor-supplied security update is the recommended resolution. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, consider refactoring the use of the wordexp function to not use the WRDE_REUSE and WRDE_APPEND flags together. Workaround: To mitigate this vulnerability, ensure that no data passed to the imaplib module contains newline or carriage return characters. Workaround: To mitigate this vulnerability, ensure that no data passed to the poplib module contains newline or carriage return characters. Workaround: Applications calling one of the vulnerable functions and allowing the alignment parameter to be set by user-controlled input can implement additional validations checks, ensuring the alignment value is a power of two and does not exceed a sane limit, for example the system page size or a maximum of 64KB. This prevents the excessively large value required to trigger the integer overflow. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, '\r' or '\n', respectively, preventing malicious sequences that could lead to header manipulation. Workaround: To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.

🔗 References (18)