RHSA-2026:80677HighCVSS 5.9

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 12, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (5)

CVE-2024-24786 →CVE-2026-109574 →CVE-2026-109595 →CVE-2026-109596 →CVE-2026-109597 →

📋 Description

CVE-2024-24786 — google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON CVE-2026-109574 — hugo: Hugo: Information disclosure via Sass import path traversal CVE-2026-109595 — hugo: Hugo: Information disclosure via path traversal during asset compilation CVE-2026-109596 — hugo: Hugo: Information disclosure via improper link resolution in nested mounts CVE-2026-109597 — hugo: Hugo: Stored cross-site scripting via crafted heading identifiers

🎯 Affected products5

  • Red Hat Hardened Images
  • hugo-0:0.167.0-0.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • hugo-0:0.167.0-0.2.hum1@s390x as a component of Red Hat Hardened Images
  • hugo-0:0.167.0-0.2.hum1@src as a component of Red Hat Hardened Images
  • hugo-0:0.167.0-0.2.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Avoid compiling Hugo sites using untrusted themes or modules containing unverified stylesheets. When processing third-party themes, execute Hugo builds within an isolated, unprivileged container environment with minimal directory mounts. Workaround: Avoid compiling Hugo sites with untrusted themes or third-party modules. When processing unverified assets, execute builds within an isolated, unprivileged container environment with minimal directory mounts and read-only host access. Workaround: Avoid compiling Hugo sites with untrusted themes or modules. When processing unverified third-party themes, execute Hugo builds within an isolated, unprivileged container environment with minimal directory mounts. Workaround: Sanitize author-submitted Markdown files or restrict untrusted contributors from defining custom explicit heading identifiers. Alternatively, avoid calling .TableOfContents or .Fragments.ToHTML within site layout templates.

🔗 References (9)