RHSA-2026:65568HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
September 8, 2026
Last Modified
September 29, 2026

🔗 CVE IDs covered (5)

CVE-2026-66046 →CVE-2026-76641 →CVE-2026-76956 →CVE-2026-76957 →CVE-2026-56411 →

📋 Description

CVE-2026-56411 — expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution CVE-2026-66046 — expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-76641 — expat: Expat: Denial of Service via XML external entity parsing CVE-2026-76956 — libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML CVE-2026-76957 — libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service

🎯 Affected products8

  • Red Hat Hardened Images
  • expat-0:2.8.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • expat-0:2.8.4-0.1.hum1@src as a component of Red Hat Hardened Images
  • expat-0:2.8.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • expat-devel-0:2.8.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • expat-devel-0:2.8.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • expat-static-0:2.8.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • expat-static-0:2.8.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate, avoid parsing untrusted XML where possible. Where parsing is required, restrict sources using network controls and enforce strict limits on document size, attribute counts, and request rates at the application or proxy level. Additionally, apply strict execution timeouts to cap parser cost and interrupt processes before they can exhaust CPU resources. Workaround: To mitigate this implement a strict "accept known good" input validation strategy that rejects any data failing to match expected specifications. Rigorously validate all length arguments, offsets, and buffer size calculations before using them to access memory boundaries. Additionally, avoid relying solely on sentinels (such as NUL characters) within untrusted input to determine array or buffer lengths. Finally, apply defense-in-depth by combining allowlists with denylists to aggressively drop outright malformed inputs before processing begins. Workaround: There is no mitigation for this flaw other than updating to libexpat 2.8.4 or later. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (9)