Skip to content
OpenAdvisories
High RHSA-2026:18868 5 CVEs

Red Hat Security Advisory: linux-sgx security update

Published May 20, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 17

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream linux-sgx 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream linux-sgx-debuginfo 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream linux-sgx-debugsource 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream sgx-common 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream sgx-enclave-devel-debuginfo 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream sgx-libs 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream sgx-libs-debuginfo 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream sgx-mpa 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream sgx-mpa-debuginfo 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream sgx-pccs 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream sgx-pccs-admin 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream sgx-pccs-debuginfo 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream sgx-pckid-tool 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream sgx-pckid-tool-debuginfo 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream tdx-attest-libs-debuginfo 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream tdx-qgs 0:2.26-7.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream tdx-qgs-debuginfo 0:2.26-7.el9

Vulnerabilities 5

  • High 8.8
    CVE-2026-23950

    node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

    node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesyst…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-23745 Public exploit

    node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

    node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root r…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-24842

    node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

    node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicio…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Alpine Wolfi npm
  • Medium 6.9
    CVE-2025-13465 Public exploit

    Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their ori…

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm
  • Low 3.7
    CVE-2025-15284

    arrayLimit bypass in bracket notation allows DoS via memory exhaustion

    Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consist…

    langfuse-3-worker katib-suggestion-hyperopt katib-earlystopping katib-suggestion-pbt-enas Debian Ubuntu Azure Linux Wolfi npm

References

  • article
    https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.8_release_notes/index
  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2425946
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430538
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2431036
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2431740
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2433645
  • article
    https://issues.redhat.com/browse/RHEL-127046
  • article
    https://issues.redhat.com/browse/RHEL-140109
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18868.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-13465
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-13465
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-13465
  • article
    https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
  • report
    https://access.redhat.com/security/cve/CVE-2025-15284
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-15284
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-15284
  • article
    https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9
  • article
    https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p
  • report
    https://access.redhat.com/security/cve/CVE-2026-23745
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23745
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23745
  • article
    https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e
  • article
    https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97
  • report
    https://access.redhat.com/security/cve/CVE-2026-23950
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23950
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23950
  • article
    https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6
  • article
    https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w
  • report
    https://access.redhat.com/security/cve/CVE-2026-24842
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-24842
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-24842
  • article
    https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46
  • article
    https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v