RHSA-2026:74536HighCVSS 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 1, 2026
Last Modified
October 21, 2026

🔗 CVE IDs covered (2)

CVE-2026-56851 →CVE-2026-76835 →

📋 Description

CVE-2026-56851 — golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile CVE-2026-76835 — github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

🎯 Affected products4

  • Red Hat Hardened Images
  • oauth2-proxy-0:7.15.5-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • oauth2-proxy-0:7.15.5-0.1.hum1@src as a component of Red Hat Hardened Images
  • oauth2-proxy-0:7.15.5-0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue without patching, apply one of the following configuration controls: 1. Restrict trusted proxy IP addresses in OAuth2 Proxy: Explicitly set the `--trusted-proxy-ip` command-line argument (or the `trusted_proxy_ip` configuration file parameter) to the specific IP address or CIDR range of authorized upstream reverse proxies or load balancers rather than relying on the default: ``` --trusted-proxy-ip=<TRUSTED_PROXY_IP_OR_CIDR> ``` 2. Sanitize forwarded headers at the perimeter reverse proxy: Configure intermediate ingress controllers or front-facing reverse proxies (such as NGINX) to strip client-supplied `X-Forwarded-Uri` headers or overwrite them with the actual request URI before forwarding traffic to OAuth2 Proxy: ``` proxy_set_header X-Forwarded-Uri $request_uri; ``` Warning: Applying these configuration adjustments requires restarting or reloading the affected OAuth2 Proxy or front-end proxy services, which may cause a brief interruption to active network sessions.

🔗 References (6)