Skip to content
OpenAdvisories
High RHSA-2026:25138 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jun 11, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 cosign 0:3.1.1-0.1.hum1

Vulnerabilities 3

  • High 7.5
    CVE-2026-48702

    Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

    Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers …

    sigstore rekor kubescape zarf Debian Ubuntu Wolfi Go
  • Low 2.3
    CVE-2026-41889

    pgx: SQL Injection via placeholder confusion with dollar quoted string literals

    pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be inte…

    jackc pgx kots k3s Debian Ubuntu Azure Linux Wolfi Go
  • Low 2.1
    CVE-2026-45287

    OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema …

    open-telemetry go.opentelemetry.io/otel/schema/v1.1 go.opentelemetry.io/otel/schema/v1.0 golang-opentelemetry-otel Debian Ubuntu Go

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-41889
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-45287
  • report
    https://access.redhat.com/security/cve/CVE-2026-48702
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25138.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468307
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41889
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41889
  • article
    https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
  • article
    https://github.com/jackc/pgx/releases/tag/v5.9.2
  • article
    https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2484831
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45287
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45287
  • article
    https://github.com/open-telemetry/opentelemetry-go/commit/e72a235518cb773137efd80336a179028bc34684
  • article
    https://github.com/open-telemetry/opentelemetry-go/commit/f12d198f161b61735d65705248715aa97021ba8d
  • article
    https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499685
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-48702
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-48702
  • article
    https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m