RHSA-2026:8814HighCVSS 8.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
April 17, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (12)

CVE-2026-34980 →CVE-2026-39316 →CVE-2025-58060 →CVE-2025-58364 →CVE-2025-64503 →CVE-2026-27447 →CVE-2026-34978 →CVE-2026-34990 →CVE-2026-39314 →CVE-2025-57812 →CVE-2025-58436 →CVE-2026-34979 →

📋 Description

CVE-2025-57812 — cups: CUPS-Filters: Information disclosure and data corruption via crafted TIFF image file processing CVE-2025-58060 — cups: Authentication Bypass in CUPS Authorization Handling CVE-2025-58364 — cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS CVE-2025-58436 — cups: Slow client communication leads to a possible DoS attack CVE-2025-64503 — cups: cups-filters: cups-filters: Out-of-bounds write via crafted PDF MediaBox CVE-2026-27447 — cups: OpenPrinting CUPS: Authorization bypass via case-insensitive username comparison CVE-2026-34978 — cups: OpenPrinting CUPS: Denial of Service via path traversal in RSS notifier CVE-2026-34979 — cups: OpenPrinting CUPS: Denial of Service via heap-based buffer overflow in job attribute processing CVE-2026-34980 — cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network CVE-2026-34990 — cups: OpenPrinting CUPS: Privilege escalation via arbitrary file overwrite due to coerced authentication CVE-2026-39314 — cups: CUPS: Denial of Service via integer underflow in IPP attribute handling CVE-2026-39316 — cups: CUPS: Denial of Service and potential arbitrary code execution via use-after-free vulnerability when deleting temporary printers.

🎯 Affected products5

  • Red Hat Hardened Images
  • cups-main@aarch64 as a component of Red Hat Hardened Images
  • cups-main@noarch as a component of Red Hat Hardened Images
  • cups-main@src as a component of Red Hat Hardened Images
  • cups-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability. It is strongly advised to apply vendor-supplied patches as soon as they are released to address this authentication bypass vulnerability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, restrict network access to the CUPS daemon to only trusted hosts or localhost. This can be achieved by configuring firewall rules to block access to TCP port 631 from untrusted networks. For example, using `firewalld`: `sudo firewall-cmd --permanent --zone=public --remove-port=631/tcp` `sudo firewall-cmd --reload` Alternatively, configure CUPS to only listen on localhost by modifying the `Listen` directive in `/etc/cups/cupsd.conf` to `Listen localhost:631`. After modifying the configuration, the CUPS service must be restarted for changes to take effect, which may temporarily interrupt printing services: `sudo systemctl restart cups`

🔗 References (16)