RHSA-2026:87400HighCVSS 8.1

Red Hat Security Advisory: Red Hat Cost Management On-Premise container image update

Published
October 21, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (18)

CVE-2026-89157 →CVE-2026-89161 →CVE-2026-103111 →CVE-2026-5545 →CVE-2026-6253 →CVE-2026-7168 →CVE-2026-18374 →CVE-2026-19553 →CVE-2026-19953 →CVE-2026-89158 →CVE-2026-6429 →CVE-2026-19445 →CVE-2026-77117 →CVE-2026-89156 →CVE-2026-8674 →CVE-2026-80489 →CVE-2026-89160 →CVE-2026-10536 →

📋 Description

CVE-2026-5545 — curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse CVE-2026-6253 — curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies CVE-2026-6429 — curl: libcurl: Credential leak via reused proxy connection during HTTP redirects CVE-2026-7168 — curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse CVE-2026-8674 — glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration CVE-2026-10536 — libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service CVE-2026-18374 — glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string CVE-2026-19445 — python: Use-after-free of a server-side SSLContext when sni_callback switches contexts CVE-2026-19553 — python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() CVE-2026-19953 — URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-77117 — glibc: Non-progress DoS in SHIFT_JISX0213 -&gt CVE-2026-80489 — glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state CVE-2026-89156 — PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback CVE-2026-89157 — pcre2: PCRE2: Out-of-bounds write via large pattern input CVE-2026-89158 — PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms CVE-2026-89160 — pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching CVE-2026-89161 — pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match CVE-2026-103111 — pcre2: pcre2: Out-of-bounds write via crafted regular expression

🎯 Affected products2

  • Red Hat Cost Management On-Premise 1
  • registry.redhat.io/costmanagement/costmanagement-ui-rhel10@sha256:4af69639e918272c5eb7f9ea54351166108b055b33303bbec472ed613acc63db_amd64 as a component of Red Hat Cost Management On-Premise 1

✅ Remediation

The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Workaround: To mitigate this issue, applications using libcurl can disable connection reuse. This can be achieved by setting one of the following libcurl options: CURLOPT_FRESH_CONNECT to force a new connection for each request, CURLOPT_MAXCONNECTS to limit the total number of open connections, or CURLMOPT_MAX_HOST_CONNECTIONS when using the curl_multi API to limit connections per host. Disabling connection reuse may impact application performance due to increased overhead for establishing new connections. Workaround: To mitigate this issue, avoid configuring curl or libcurl to use proxies that require credentials. This prevents the scenario where credentials for a first proxy could be inadvertently passed to a second proxy during a redirect. Workaround: To prevent the credential leak, avoid using the combination of .netrc for credentials, clear text HTTP URLs, and an HTTP proxy when making requests with libcurl. This operational control prevents the specific conditions that enable the vulnerability. Workaround: To mitigate this issue, applications using libcurl should avoid reusing handles when switching between different HTTP proxies, especially after performing Digest authentication. This operational control prevents the unintended disclosure of `Proxy-Authorization` headers to subsequent proxy hosts. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, avoid configuring HTTP/2 stream dependencies within applications utilizing libcurl. This functionality is considered deprecated and its use is required to trigger the vulnerability. Workaround: Restrict Python TLS servers that use SSLContext.sni_callback to trusted clients. Keep a strong reference to every SSLContext that registers an SNI callback for the lifetime of the server so the original context cannot be garbage-collected while connections remain open. Prefer wrapping the listening socket with a long-lived SSLContext; that common pattern is not affected. Host heap allocator hardening increases the difficulty of turning the use-after-free into reliable code execution but does not prevent process crashes. Workaround: Restrict Python TLS clients to trusted networks so an on-path attacker cannot intercept sessions. Applications that use SSLContext.wrap_bio(), asyncio.create_connection(), or loop.start_tls() with check_hostname enabled must pass a non-empty server_hostname; hostname verification then proceeds and this flaw is not reachable. Optionally pin expected server certificates so a mismatched host certificate is rejected even if hostname checking is skipped. Workaround: Do not convert untrusted input using the SHIFT_JISX0213 character set (for example via iconv). Where conversion cannot be avoided, apply process CPU time limits and container cgroup resource limits so a hung converter cannot exhaust host resources. Workaround: To mitigate this avoid converting untrusted data with that charset, or disable the conversion path if unused. Where conversion of untrusted input cannot be avoided, restrict access to trusted clients and apply process CPU/resource limits to contain hang impact.

🔗 References (24)