RHSA-2026:82247MediumCVSS 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 13, 2026
Last Modified
October 15, 2026

🔗 CVE IDs covered (5)

CVE-2026-106586 →CVE-2026-110923 →CVE-2026-110925 →CVE-2026-110926 →CVE-2026-110927 →

📋 Description

CVE-2026-106586 — openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding CVE-2026-110923 — openssh: openssh: sftp can write outside the destination directory from a server-supplied path CVE-2026-110925 — openssh: openssh: '$' and '' in a command-line username expand through %u CVE-2026-110926 — openssh: openssh: shared LZ77 compression dictionary leaks plaintext across channels CVE-2026-110927 — openssh: openssh: a compressed payload can expand past the maximum packet size

🎯 Affected products23

  • Red Hat Hardened Images
  • openssh-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-0:10.5p1-1.2.hum1@src as a component of Red Hat Hardened Images
  • openssh-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-askpass-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-askpass-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-askpass-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-clients-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-clients-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-clients-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-keycat-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-keycat-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-keycat-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-keysign-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-keysign-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-keysign-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-server-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-server-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-server-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Do not use sftp to copy from a server you do not trust. There is no configuration switch that closes this path. Workaround: Do not place an untrusted username on the ssh command line when ProxyCommand or Match exec expands %u. Avoid expanding %u into a shell command. Workaround: Leave Compression disabled. The client default is already off. Prefer application-level compression instead of SSH compression. Workaround: Leave Compression disabled. The client default is already off.

🔗 References (15)