Skip to content
OpenAdvisories
High RHSA-2026:15862 5 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jun 17, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 trivy 0:0.69.3-1.2.hum1

Vulnerabilities 5

  • High 8.9
    CVE-2026-44432

    urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

    urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Br…

    urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Wolfi PyPI
  • High 8.4
    CVE-2026-53492

    containerd CRI checkpoint restore CDI annotation smuggling

    containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. W…

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.2
    CVE-2026-53489

    containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

    containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on t…

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.3
    CVE-2026-40898

    quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

    quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large traile…

    quic-go quic-go k3s k3s-static Debian Ubuntu Wolfi Go
  • Low 2.1
    CVE-2026-45287

    OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema …

    open-telemetry go.opentelemetry.io/otel/schema/v1.1 go.opentelemetry.io/otel/schema/v1.0 golang-opentelemetry-otel Debian Ubuntu Go

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-45287
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-44432
  • report
    https://access.redhat.com/security/cve/CVE-2026-53492
  • report
    https://access.redhat.com/security/cve/CVE-2026-53489
  • report
    https://access.redhat.com/security/cve/CVE-2026-40898
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_15862.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2484875
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-40898
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-40898
  • article
    https://github.com/quic-go/quic-go/releases/tag/v0.59.1
  • article
    https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477154
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44432
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44432
  • article
    https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2484831
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45287
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45287
  • article
    https://github.com/open-telemetry/opentelemetry-go/commit/e72a235518cb773137efd80336a179028bc34684
  • article
    https://github.com/open-telemetry/opentelemetry-go/commit/f12d198f161b61735d65705248715aa97021ba8d
  • article
    https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496129
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53489
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53489
  • article
    https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496130
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53492
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53492
  • article
    https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc