Skip to content
OpenAdvisories
High RHSA-2026:25039 6 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jun 19, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 jaeger 0:2.19.0-1.hum1

Vulnerabilities 6

  • High 8.9
    CVE-2026-44432

    urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

    urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Br…

    urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Wolfi PyPI
  • High 8.2
    CVE-2026-44431

    urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

    urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerabili…

    urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-42151

    Prometheus Azure AD remote write OAuth client secret exposed via config API

    Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus re…

    prometheus prometheus k8sgpt minio Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-42154 Public exploit

    Prometheus: remote read endpoint allows denial of service via crafted snappy payload

    Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An…

    prometheus prometheus k8sgpt minio Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.9
    CVE-2026-45409

    Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

    Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `"\u0660" * N` or `"\u30fb" * N …

    kjd idna open-webui katib-suggestion-hyperopt Debian Ubuntu Wolfi PyPI
  • Medium 5.3
    CVE-2026-48990

    joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_leng…

    authlib joserfc airflow-3 joserfc Debian Ubuntu Wolfi PyPI

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-48990
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-44432
  • report
    https://access.redhat.com/security/cve/CVE-2026-44431
  • report
    https://access.redhat.com/security/cve/CVE-2026-42154
  • report
    https://access.redhat.com/security/cve/CVE-2026-42151
  • report
    https://access.redhat.com/security/cve/CVE-2026-45409
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25039.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2466507
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42151
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42151
  • article
    https://github.com/prometheus/prometheus/pull/18587
  • article
    https://github.com/prometheus/prometheus/pull/18590
  • article
    https://github.com/prometheus/prometheus/releases/tag/v3.11.3
  • article
    https://github.com/prometheus/prometheus/releases/tag/v3.5.3
  • article
    https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2466505
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42154
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42154
  • article
    https://github.com/prometheus/prometheus/pull/18584
  • article
    https://github.com/prometheus/prometheus/pull/18585
  • article
    https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477167
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44431
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44431
  • article
    https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477154
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44432
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44432
  • article
    https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2485616
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45409
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45409
  • article
    https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2490168
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-48990
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-48990
  • article
    https://github.com/authlib/joserfc/releases/tag/1.6.7