RHSA-2026:83603HighCVSS 7.5

Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release

Published
October 15, 2026
Last Modified
October 20, 2026

🔗 CVE IDs covered (2)

CVE-2026-18140 →CVE-2026-93599 →

📋 Description

CVE-2026-18140 — aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON CVE-2026-93599 — rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List

🎯 Affected products6

  • Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/tuffer-rhel9@sha256:6171943a8081a69eafc494b539b51f173e5ee59b2b350cc149ae43c0d96a3c96_amd64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/tuftool-rhel9@sha256:571141fdcf8373e9f7e8011fe4e531ede17480002c395b2421191d037b4bdae2_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/tuftool-rhel9@sha256:df6b6e032f50b72f354c5c31c490a68cdf8ddb177641deee9e400b46800c1250_amd64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/tuftool-rhel9@sha256:e0652f98386f3979bf1ce31423b696767db5d2b824c9a9848b4cf974a754c089_arm64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/tuftool-rhel9@sha256:ffc1238769e637d90871551ffc0eafb85e3ab4bdea4b38d6c71f288222b27f16_s390x as a component of Red Hat Trusted Artifact Signer 1.4

✅ Remediation

Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index Workaround: Restrict network access to services that process JSON input using the `aws-smithy-json` runtime. Configure firewalls to limit incoming connections to trusted sources, thereby reducing the exposure to remote unauthenticated denial of service attacks. If the service is reloaded or restarted, ensure firewall rules persist.

🔗 References (7)