Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image
🔗 CVE IDs covered (5)
📋 Description
CVE-2026-9496 — pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-90711 — proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet CVE-2026-97057 — redis-parser: redis-parser: Denial of Service via invalid RESP protocol array length CVE-2026-102276 — brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns CVE-2026-102278 — brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns
🎯 Affected products2
- Red Hat Satellite 6.19
- registry.redhat.io/satellite/iop-remediations-rhel9@sha256:010978354f35d599043d0f33f17707bca5972f150bc6fa1a23d962638d3e825e_amd64 as a component of Red Hat Satellite 6.19
✅ Remediation
For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. Workaround: To mitigate this limit the length of incoming package specifiers (spec.rawSpec) before they reach the resolution service. Enforce hard CPU time limits or timeouts on isolated build jobs and package resolution processes. Workaround: To mitigate this flaw through configuration: 1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation. 2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`). 3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications. Warning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
🔗 References (12)
- selfhttps://access.redhat.com/errata/RHSA-2026:92578
- externalhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index
- externalhttps://access.redhat.com/security/cve/CVE-2026-102276
- externalhttps://access.redhat.com/security/cve/CVE-2026-102278
- externalhttps://access.redhat.com/security/cve/CVE-2026-90711
- externalhttps://access.redhat.com/security/cve/CVE-2026-9496
- externalhttps://access.redhat.com/security/cve/CVE-2026-97057
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://catalog.redhat.com/software/containers/search
- externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite
- externalhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92578.json