Skip to content
OpenAdvisories
Medium RHSA-2026:24577 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jun 17, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 hugo 0:0.162.1-1.hum1

Vulnerabilities 3

  • Medium 6.9
    CVE-2026-50135

    Hugo: Symlink confinement bypass in resources.Get

    Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made  RootMappingFs.statRoot  use  Stat  (follows symlinks) instead of  Lstat , so a direct  resources.Get  of a symlink pointing outside its mount returned the target's contents — letting…

    gohugoio hugo hugo hugo Debian Ubuntu Go
  • Medium 6.3
    CVE-2026-50134

    Hugo: security.http.urls allow-list bypass via HTTP redirects

    Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS…

    gohugoio hugo hugo hugo Debian Ubuntu Go
  • Low 2.1
    CVE-2026-45287

    OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema …

    open-telemetry go.opentelemetry.io/otel/schema/v1.0 go.opentelemetry.io/otel/schema/v1.1 golang-opentelemetry-otel Debian Ubuntu Go

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-45287
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-50134
  • report
    https://access.redhat.com/security/cve/CVE-2026-50135
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24577.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2484831
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45287
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45287
  • article
    https://github.com/open-telemetry/opentelemetry-go/commit/e72a235518cb773137efd80336a179028bc34684
  • article
    https://github.com/open-telemetry/opentelemetry-go/commit/f12d198f161b61735d65705248715aa97021ba8d
  • article
    https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497451
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-50134
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-50134
  • article
    https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50
  • article
    https://github.com/gohugoio/hugo/releases/tag/v0.162.0
  • article
    https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497518
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-50135
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-50135
  • article
    https://github.com/gohugoio/hugo/commit/f8b5fa09a64950c32b803821ede411ebfe772b7a
  • article
    https://github.com/gohugoio/hugo/security/advisories/GHSA-fw87-fv5r-9fpw