RHSA-2026:72277MediumCVSS 7.8

Red Hat Security Advisory: rrdtool security update

Published
September 28, 2026
Last Modified
September 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-43958 →

📋 Description

CVE-2026-43958 — rrdtool: rrdtool: Stack buffer overflow allows local code execution or denial of service

🎯 Affected products46

  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • python3-rrdtool-debuginfo-0:1.7.2-21.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • python3-rrdtool-debuginfo-0:1.7.2-21.el9_2.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • python3-rrdtool-debuginfo-0:1.7.2-21.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • python3-rrdtool-debuginfo-0:1.7.2-21.el9_2.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • python3-rrdtool-debuginfo-0:1.7.2-21.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-0:1.7.2-21.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-0:1.7.2-21.el9_2.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-0:1.7.2-21.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-0:1.7.2-21.el9_2.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-0:1.7.2-21.el9_2.1.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-0:1.7.2-21.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-debuginfo-0:1.7.2-21.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-debuginfo-0:1.7.2-21.el9_2.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-debuginfo-0:1.7.2-21.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-debuginfo-0:1.7.2-21.el9_2.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-debuginfo-0:1.7.2-21.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-debugsource-0:1.7.2-21.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-debugsource-0:1.7.2-21.el9_2.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-debugsource-0:1.7.2-21.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-debugsource-0:1.7.2-21.el9_2.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-debugsource-0:1.7.2-21.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-lua-debuginfo-0:1.7.2-21.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-lua-debuginfo-0:1.7.2-21.el9_2.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-lua-debuginfo-0:1.7.2-21.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-lua-debuginfo-0:1.7.2-21.el9_2.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-lua-debuginfo-0:1.7.2-21.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-perl-0:1.7.2-21.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-perl-0:1.7.2-21.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • rrdtool-perl-0:1.7.2-21.el9_2.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • +16 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Restrict access to the `rrdcached` UNIX socket using filesystem permissions and group ownership to prevent untrusted local users from connecting. Avoid exposing `rrdcached` on TCP listeners unless strictly necessary, and ensure any such listeners are protected by network access controls. Additionally, run the `rrdcached` daemon as an unprivileged user and group using the `-U` and `-G` options to minimize impact in case of compromise. If `rrdcached` is restarted or reloaded, these configurations will be reapplied.

🔗 References (4)