RHSA-2026:59361HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
August 25, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (5)

CVE-2026-53586 →CVE-2026-53587 →CVE-2026-53583 →CVE-2026-53584 →CVE-2026-53585 →

📋 Description

CVE-2026-53583 — libgit2: libgit2: Network attacker can intercept HTTPS connections via inverted IP SubjectAltName comparison CVE-2026-53584 — libgit2: libgit2: Submodule path traversal allows arbitrary directory creation CVE-2026-53585 — libgit2: libgit2: Denial of Service via Unbounded Memory Allocation CVE-2026-53586 — libgit2: libgit2: Information disclosure via HTTP redirect allows credential leakage CVE-2026-53587 — libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server

🎯 Affected products4

  • Red Hat Hardened Images
  • libgit2-main@aarch64 as a component of Red Hat Hardened Images
  • libgit2-main@src as a component of Red Hat Hardened Images
  • libgit2-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, avoid cloning or fetching from untrusted Git repositories. Restricting access to systems that perform Git operations on untrusted data can also reduce exposure.

🔗 References (9)