Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 5

Vulnerabilities 6

• High 7.5
  CVE-2026-45591

  ASP.NET Core Denial of Service Vulnerability

  Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  Microsoft .NET 9.0 runtime .NET 10.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet
  Jun 9, 2026
• High 7.5
  CVE-2026-59724

  Socket.IO: Engine.IO WebTransport SID DoS

  Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object durin…

  socketio socket.io jupyter-base-notebook engine.io Wolfi npm
  Jul 8, 2026
• High 7.5
  CVE-2026-59870

  js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

  js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consum…

  nodeca js-yaml renovate js-yaml Ubuntu Wolfi npm
  Jul 8, 2026
• Medium 6.2
  CVE-2026-45491

  .NET Tampering Vulnerability

  Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

  Microsoft .NET 9.0 runtime .NET 10.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet
  Jun 9, 2026
• Medium 5.3
  CVE-2026-59868

  js-yaml: YAML merge-key chains can force quadratic CPU consumption

  js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

  nodeca js-yaml js-yaml node-js-yaml Ubuntu npm
  Jul 8, 2026
• Medium 4.4
  CVE-2026-45736

  ws: Uninitialized memory disclosure

  ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

  websockets ws langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  May 15, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-45591
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-45491
• report
  https://access.redhat.com/security/cve/CVE-2026-45736
• report
  https://access.redhat.com/security/cve/CVE-2026-59870
• report
  https://access.redhat.com/security/cve/CVE-2026-59868
• report
  https://access.redhat.com/security/cve/CVE-2026-59724
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26994.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2487164
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45491
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45491
• article
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2487224
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45591
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45591
• article
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45591
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477914
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45736
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45736
• article
  https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086
• article
  https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498128
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59724
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59724
• article
  https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c
• article
  https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7
• article
  https://github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498114
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59868
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59868
• article
  https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1
• article
  https://github.com/nodeca/js-yaml/releases/tag/5.2.0
• article
  https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498130
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59870
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59870
• article
  https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe
• article
  https://github.com/nodeca/js-yaml/releases/tag/5.2.1