RHSA-2026:80765HighCVSS 8.2

Red Hat Security Advisory: goose security update

Published
October 12, 2026
Last Modified
October 19, 2026

🔗 CVE IDs covered (4)

CVE-2026-93599 →CVE-2026-63127 →CVE-2026-63128 →CVE-2026-72718 →

📋 Description

CVE-2026-63127 — rmcp: RMCP: Token impersonation via missing OAuth resource field validation CVE-2026-63128 — rmcp: RMCP: Denial of Service via unauthenticated session table leak CVE-2026-72718 — goose: Goose: Arbitrary command execution via malicious Git configuration in goose review CVE-2026-93599 — rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List

🎯 Affected products14

  • Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-0:1.45.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-0:1.45.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-0:1.45.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-0:1.45.0-1.el10_2.src as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-0:1.45.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-debuginfo-0:1.45.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-debuginfo-0:1.45.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-debuginfo-0:1.45.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-debuginfo-0:1.45.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-debugsource-0:1.45.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-debugsource-0:1.45.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-debugsource-0:1.45.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)
  • goose-debugsource-0:1.45.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 10)

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, restrict network access to the service utilizing the `rmcp` Streamable HTTP server to trusted clients only. Implement firewall rules to limit inbound connections to the specific port and IP addresses where the vulnerable service is exposed.

🔗 References (4)