RHSA-2026:86200HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 20, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-65627 →

📋 Description

CVE-2026-65627 — jose: jose: Denial of Service via unbounded decompression of crafted JWE tokens

🎯 Affected products5

  • Red Hat Hardened Images
  • rabbitmq-server4.3-0:4.3.7-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rabbitmq-server4.3-0:4.3.7-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • rabbitmq-server4.3-0:4.3.7-0.1.hum1@src as a component of Red Hat Hardened Images
  • rabbitmq-server4.3-0:4.3.7-0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Reject JWE tokens carrying the "zip": "DEF" header at the application gateway or API perimeter before decryption routines are executed. --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounded decompression during JWE block decryption in jose: upgrade to jose 1.11.13 (or the corresponding fixed Red Hat builds), which perform incremental decompression via zlib:safeInflate/2 and abort with a badarg error if output exceeds a configurable ceiling, closing all 2 injection vectors (crafted JWE token with zip DEF header, DEFLATE decompression bomb). Until patched, this is a concern on applications decrypting JWE tokens using jose, so reject JWE tokens carrying the zip DEF header at the application gateway or API perimeter before decryption routines are executed. As a compensating measure, monitor cgroup memory pressure events and PSI to detect rapid memory spikes and out-of-memory pressure caused by decompression bombs. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded decompression defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)

🔗 References (5)