Skip to content
OpenAdvisories
High RHSA-2026:32963 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jul 3, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grype 0:0.115.0-0.1.hum1

Vulnerabilities 4

  • High 8.4
    CVE-2026-53492

    containerd CRI checkpoint restore CDI annotation smuggling

    containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. W…

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.2
    CVE-2026-53489

    containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

    containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on t…

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.5
    CVE-2026-44740

    go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

    Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumptio…

    go-git go-billy scorecard kyverno-cli-1.17 Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-47262

    containerd image-triggered runtime DoS via unbounded group parsing

    containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, …

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-47262
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-53492
  • report
    https://access.redhat.com/security/cve/CVE-2026-53489
  • report
    https://access.redhat.com/security/cve/CVE-2026-44740
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_32963.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2483894
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44740
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44740
  • article
    https://github.com/go-git/go-billy/releases/tag/v5.9.0
  • article
    https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1
  • article
    https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496126
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-47262
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-47262
  • article
    https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496129
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53489
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53489
  • article
    https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496130
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53492
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53492
  • article
    https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc