Skip to content
OpenAdvisories
Medium RHSA-2026:11316 5 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Apr 28, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 27

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 avahi 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-autoipd 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-compat-howl 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-compat-howl-devel 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-compat-libdns_sd 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-compat-libdns_sd-devel 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-devel 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-dnsconfd 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-glib 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-glib-devel 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-gobject 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-gobject-devel 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-libs 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-qt3 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-qt3-devel 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-qt4 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-qt4-devel 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-qt5 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-qt5-devel 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-sharp 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-tools 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-ui 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-ui-devel 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-ui-gtk3 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-ui-sharp 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-ui-sharp-devel 0:0.9~rc4-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 avahi-ui-tools 0:0.9~rc4-0.1.hum1

Vulnerabilities 5

  • Medium 6.5
    CVE-2025-68468

    Avahi has a reachable assertion in lookup_multicast_callback

    Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource rec…

    avahi avahi avahi avahi Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2025-68471

    Avahi has a reachable assertion in lookup_start

    Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.

    avahi avahi avahi avahi Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2026-24401

    Avahi has Uncontrolled Recursion in lookup_handle_cname function

    Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAM…

    avahi avahi avahi avahi Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.5
    CVE-2025-68276

    Avahi has a reachable assertion in avahi_wide_area_scan_cache

    Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP…

    avahi avahi avahi avahi Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.5
    CVE-2026-34933

    Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon

    Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. Thi…

    avahi avahi avahi avahi Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-68276
  • report
    https://access.redhat.com/security/cve/CVE-2025-68468
  • report
    https://access.redhat.com/security/cve/CVE-2025-68471
  • report
    https://access.redhat.com/security/cve/CVE-2026-24401
  • report
    https://access.redhat.com/security/cve/CVE-2026-34933
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11316.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2428713
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68276
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68276
  • article
    https://github.com/avahi/avahi/commit/ede7048475c5d47d53890e3bc1350dda8e0b3688
  • article
    https://github.com/avahi/avahi/pull/806
  • article
    https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2428714
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68468
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68468
  • article
    https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a
  • article
    https://github.com/avahi/avahi/issues/683
  • article
    https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2428717
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68471
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68471
  • article
    https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1
  • article
    https://github.com/avahi/avahi/issues/678
  • article
    https://github.com/avahi/avahi/security/advisories/GHSA-56rf-42xr-qmmg
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2432534
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-24401
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-24401
  • article
    https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524
  • article
    https://github.com/avahi/avahi/issues/501
  • article
    https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2454978
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34933
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34933
  • article
    https://github.com/avahi/avahi/commit/625ca0fac19229f6dfa3a6c6b698ae657187e50c
  • article
    https://github.com/avahi/avahi/pull/891
  • article
    https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc