RHSA-2026:66018HighCVSS 8.2

Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update

Published
September 9, 2026
Last Modified
September 11, 2026

🔗 CVE IDs covered (30)

CVE-2026-58015 →CVE-2026-58055 →CVE-2026-59886 →CVE-2026-58013 →CVE-2026-8286 →CVE-2026-11822 →CVE-2026-11824 →CVE-2026-60005 →CVE-2026-5704 →CVE-2026-11940 →CVE-2026-11979 →CVE-2026-54371 →CVE-2026-6653 →CVE-2026-55203 →CVE-2026-58010 →CVE-2026-41992 →CVE-2026-56434 →CVE-2026-58014 →CVE-2026-18508 →CVE-2026-9547 →CVE-2026-15588 →CVE-2026-18477 →CVE-2026-41991 →CVE-2026-45409 →CVE-2026-3783 →CVE-2026-16730 →CVE-2026-58011 →CVE-2026-1965 →CVE-2026-55204 →CVE-2026-58012 →

📋 Description

CVE-2026-1965 — curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-3783 — curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect CVE-2026-5704 — tar: tar: Hidden file injection via crafted archives CVE-2026-6653 — libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-8286 — curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-9547 — curl: curl: Man-in-the-middle attack via SSH host key bypass CVE-2026-11822 — sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11824 — sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 CVE-2026-11940 — python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11979 — libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow CVE-2026-15588 — GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering CVE-2026-16730 — dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup CVE-2026-18477 — tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18508 — tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite CVE-2026-41991 — gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility CVE-2026-41992 — gzip: gzip: Information disclosure via global buffer overflow in LZH decompression CVE-2026-45409 — python-idna: idna: Denial of Service via specially crafted long inputs CVE-2026-54371 — attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-55203 — haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling CVE-2026-55204 — haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-56434 — nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-58010 — glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() CVE-2026-58011 — glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime CVE-2026-58012 — glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() CVE-2026-58013 — glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" CVE-2026-58014 — glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" CVE-2026-58015 — glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive CVE-2026-58055 — nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-59886 — pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values CVE-2026-60005 — nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module

🎯 Affected products6

  • Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:7840142734dad76221aa6846ab6e8aacc913a8017e4c5c956d574f78b8dfa98d_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/cds-rhel9@sha256:53eede6ba9dc80a9430d598f63e6ea9dbfb7f92b2cf778577c692ec2af8c9499_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/haproxy-rhel9@sha256:3460a52ef50810d3a1077fd21d13b0d07e51e50af6f41958afa8e319b2954a1c_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/installer-rhel9@sha256:4184dd496e0c466b594d035371df0801b54e4825f91016d47cd0003b99ce87c7_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/rhua-rhel9@sha256:ace80f39f33d921b97be5c74257b52d64170e4eac4b0e2db7d7d13a598d38450_amd64 as a component of Red Hat Update Infrastructure 5

✅ Remediation

The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations. Workaround: To mitigate this issue, avoid extracting archives from untrusted sources. If processing untrusted archives is necessary, do so within a sandboxed environment to limit potential impact. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Do not perform incremental restores (-G/-g) from untrusted archives. Avoid restoring incremental backups on systems where untrusted users have shell access,​ perform restoration only on systems inaccessible to users. Workaround: Do not use --one-top-level as the sole confinement mechanism when extracting untrusted archives. Prefer extracting as an unprivileged user into a freshly created empty directory after changing into that directory (mkdir and cd), avoid extracting as root from sensitive working directories such as /, and follow the GNU tar security guidance for untrusted archives. Workaround: Ensure that the mktemp utility (provided by the coreutils package) is available in PATH when using the gzexe utility. On Red Hat Enterprise Linux, mktemp is installed by default and no additional action is needed. Workaround: To mitigate this denial-of-service vulnerability, applications utilizing the `idna` Python library should implement input validation to ensure that domain names do not exceed the standard 253-character length limit before being passed to the `idna.encode()` function. This operational control prevents the processing of excessively long inputs that could lead to resource exhaustion and service unavailability. Applications that pass user-controlled data directly to `idna.encode()` without validation checks (e.g.: DNS length < 254 chars) are affected. Workaround: To mitigate this issue, restrict access to HAProxy instances that utilize FastCGI to trusted FastCGI backends only. If FastCGI is not required, consider disabling its use in HAProxy configurations to eliminate the attack vector. Ensure that all FastCGI backends are secured and not susceptible to compromise. If the HAProxy service is reloaded or restarted after configuration changes, ensure proper validation of the new configuration. Workaround: To prevent exploitation, avoid configuring NGINX with `ngx_http_ssi_module` when `proxy_pass` and `proxy_buffering off` are simultaneously active. If Server-Side Includes (SSI) are not essential, disable the `ngx_http_ssi_module` by removing or commenting out the `ssi on;` directive. Alternatively, ensure `proxy_buffering` is explicitly enabled (`proxy_buffering on;`) when `proxy_pass` is used with SSI. A reload or restart of the NGINX service is necessary for configuration changes to apply, which may cause a brief service interruption. Workaround: To mitigate this vulnerability, in applications processing user-supplied dates, implement input validation to ensure the supplied date is within the supported range before calling g_date_time_add_full() with untrusted data, specifically rejecting inputs that result in a negative or zero days field. Workaround: To mitigate this vulnerability, implement strict input validation to sanitize user-supplied replacement strings, specifically rejecting or escaping case-change modifiers (\u, \l, \U, \L) before calling g_regex_replace() or g_regex_replace_eval() when the G_REGEX_RAW compile flag is used. Removing the G_REGEX_RAW flag or hardcoding the replacement strings will completely neutralize this issue. Workaround: To mitigate this vulnerability, restrict any custom line terminator string passed to g_io_channel_set_line_term() to a maximum length of one byte before calling g_io_channel_read_line_backend(). Using the default line terminators will completely neutralize this issue. Workaround: To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue. Workaround: To mitigate this vulnerability, ensure that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle (MitM) attacks. If feasible, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will completely neutralize this issue. Workaround: Configure your WAF or load balancer to drop incoming HTTP/1.1 requests that contain both Upgrade and Content-Length headers. This blocks the malformed traffic at the edge before it can reach the vulnerable proxy without impacting legitimate users. Workaround: When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion. Workaround: To mitigate this issue, disable the ngx_http_slice_module entirely if it is not required. If the module must be used, avoid unnamed regex captures with the slice directive and explicitly disable proxy_cache_background_update. Reload or restart the NGINX service to apply these changes. Please note this may cause a brief service interruption.

🔗 References (35)