Skip to content
OpenAdvisories
High RHSA-2026:34119 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jul 10, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 python-rpds-py 0:2026.6.3-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3-rpds-py 0:2026.6.3-1.hum1

Vulnerabilities 4

  • High 8.2
    CVE-2026-44431

    urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

    urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerabili…

    urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-49476

    Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve

    Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted …

    facelessuser soupsieve open-webui kubeflow-pipelines-visualization-server Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-49477

    Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser

    Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminat…

    facelessuser soupsieve open-webui kubeflow-pipelines-visualization-server Debian Ubuntu Wolfi PyPI
  • Medium 6.9
    CVE-2026-45409

    Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

    Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `"\u0660" * N` or `"\u30fb" * N …

    kjd idna open-webui katib-suggestion-hyperopt Debian Ubuntu Wolfi PyPI

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-45409
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-49477
  • report
    https://access.redhat.com/security/cve/CVE-2026-49476
  • report
    https://access.redhat.com/security/cve/CVE-2026-44431
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34119.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477167
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44431
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44431
  • article
    https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2485616
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45409
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45409
  • article
    https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500715
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49476
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49476
  • article
    https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39
  • article
    https://github.com/facelessuser/soupsieve/releases/tag/2.8.4
  • article
    https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500752
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49477
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49477
  • article
    https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3
  • article
    https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37