RHSA-2026:7261HighCVSS 9.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
April 9, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (23)

CVE-2025-9232 →CVE-2025-15467 →CVE-2025-15468 →CVE-2025-66199 →CVE-2025-68160 →CVE-2025-69418 →CVE-2025-69419 →CVE-2025-69421 →CVE-2025-69420 →CVE-2026-22795 →CVE-2026-22796 →CVE-2026-28387 →CVE-2026-28389 →CVE-2026-31789 →CVE-2025-15469 →CVE-2026-2673 →CVE-2026-28386 →CVE-2026-31790 →CVE-2025-9230 →CVE-2025-9231 →CVE-2025-11187 →CVE-2026-28388 →CVE-2026-28390 →

📋 Description

CVE-2025-9230 — openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-9231 — openssl: Timing side-channel in SM2 algorithm on 64 bit ARM CVE-2025-9232 — openssl: Out-of-bounds read in HTTP client no_proxy handling CVE-2025-11187 — openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file CVE-2025-15467 — openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing CVE-2025-15468 — openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling CVE-2025-15469 — openssl: OpenSSL: Data integrity bypass in openssl dgst command due to silent truncation CVE-2025-66199 — openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression CVE-2025-68160 — openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter CVE-2025-69418 — openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls CVE-2025-69419 — openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing CVE-2025-69420 — openssl: OpenSSL: Denial of Service via malformed TimeStamp Response CVE-2025-69421 — openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing CVE-2026-2673 — openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group CVE-2026-22795 — openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing CVE-2026-22796 — openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification CVE-2026-28386 — openssl: openssl: Denial of Service due to out-of-bounds read in AES-CFB128 CVE-2026-28387 — openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication CVE-2026-28388 — openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing CVE-2026-28389 — openssl: OpenSSL: Denial of Service vulnerability in CMS processing CVE-2026-28390 — openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing CVE-2026-31789 — openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31790 — openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

🎯 Affected products4

  • Red Hat Hardened Images
  • openssl-main@aarch64 as a component of Red Hat Hardened Images
  • openssl-main@src as a component of Red Hat Hardened Images
  • openssl-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, avoid processing untrusted PKCS#12 files. Applications should only handle PKCS#12 files from trusted sources, as these files are typically used for storing private keys and are expected to be secure. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, avoid using the `openssl dgst` command with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) for files larger than 16MB. Instead, utilize streaming digest algorithms with `openssl dgst` or use library APIs for signing and verification, as these are not affected by the truncation vulnerability. Users should ensure that input files for one-shot signing/verification with `openssl dgst` do not exceed 16MB. Workaround: To mitigate this issue, disable the reception of compressed certificates by setting the SSL_OP_NO_RX_CERTIFICATE_COMPRESSION option in OpenSSL configurations. This will prevent the vulnerable code path from being exercised. Workaround: To mitigate this vulnerability, Red Hat recommends avoiding the processing of PKCS#12 files from untrusted or unverified sources. Applications that use the `PKCS12_get_friendlyname()` API should ensure that PKCS#12 files are only processed if they originate from trusted entities. Restricting the input sources for PKCS#12 files can significantly reduce the attack surface for this flaw. Workaround: Restrict applications from processing untrusted or externally supplied PKCS#12 files, ensuring certificates are sourced only from trusted internal authorities. Additionally, configure critical background services with automatic restart policies (such as systemd's Restart=on-failure) to quickly restore availability if a denial-of-service crash occurs. Workaround: To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification. Workaround: To mitigate this issue, avoid processing untrusted CMS EnvelopedData messages with KeyAgreeRecipientInfo. Restrict network access to services that process CMS data from untrusted sources. If possible, configure applications to only accept CMS data from trusted origins. This operational control helps reduce exposure to the vulnerability. Workaround: Applications that process Cryptographic Message Syntax (CMS) EnvelopedData messages should be configured to only accept input from trusted sources. Restricting network access to services that process untrusted CMS data can also reduce exposure to this Denial of Service vulnerability. Workaround: To mitigate this issue, avoid processing or logging untrusted X.509 certificates, particularly those with unusually large OCTET STRING values. Restricting the source of X.509 certificates to trusted entities can reduce exposure to this vulnerability.

🔗 References (27)