Skip to content
OpenAdvisories
High RHSA-2026:14125 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published May 20, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 28

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 php 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-bcmath 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-cli 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-common 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-dba 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-dbg 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-devel 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-embedded 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-enchant 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-ffi 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-fpm 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-gd 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-gmp 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-intl 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-ldap 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-mbstring 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-mysqlnd 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-odbc 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-pdo 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-pdo-dblib 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-pdo-firebird 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-pgsql 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-process 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-snmp 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-soap 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-sodium 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-tidy 0:8.5.6-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 php-xml 0:8.5.6-1.hum1

Vulnerabilities 2

  • High 7.3
    CVE-2026-6735 Public exploit

    XSS within PHP-FPM status endpoint

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the …

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.3
    CVE-2026-7258

    Out-of-bounds read in urldecode() on NetBSD

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lo…

    PHP Group PHP php php8.2 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-7258
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-6735
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14125.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468562
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6735
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6735
  • article
    https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468561
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-7258
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-7258
  • article
    https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4