Skip to content
OpenAdvisories
High RHSA-2026:37577 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Jul 11, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 aspnetcore-runtime-8.0 0:8.0.28-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 aspnetcore-runtime-dbg-8.0 0:8.0.28-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 aspnetcore-targeting-pack-8.0 0:8.0.28-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-apphost-pack-8.0 0:8.0.28-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-hostfxr-8.0 0:8.0.28-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-runtime-8.0 0:8.0.28-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-runtime-dbg-8.0 0:8.0.28-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-sdk-8.0 0:8.0.128-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-sdk-8.0-source-built-artifacts 0:8.0.128-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-sdk-dbg-8.0 0:8.0.128-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-targeting-pack-8.0 0:8.0.28-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-templates-8.0 0:8.0.128-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet8.0 0:8.0.128-1.1.hum1

Vulnerabilities 4

  • High 7.5
    CVE-2026-59725

    Socket.IO: Engine.IO Polling Transport Connection Exhaustion

    Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-…

    socketio engine.io jupyter-base-notebook engine.io Wolfi npm
  • High 7.5
    CVE-2026-59869

    js-yaml: YAML merge-key chains can force quadratic CPU consumption

    js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

    nodeca js-yaml katib-suggestion-hyperopt prism Debian Ubuntu Azure Linux Wolfi npm
  • Medium 6.2
    CVE-2026-39245

    decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file…

  • Medium 5.5
    CVE-2026-39243

    decompress allows arbitrary hardlink creation during archive extraction

    decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() …

    decompress npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-59725
  • report
    https://access.redhat.com/security/cve/CVE-2026-59869
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-39243
  • report
    https://access.redhat.com/security/cve/CVE-2026-39245
  • article
    https://access.redhat.com/security/cve/CVE-2020-12265
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37577.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498833
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-39243
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-39243
  • article
    https://github.com/kevva/decompress
  • article
    https://github.com/kevva/decompress/issues/113
  • article
    https://www.npmjs.com/package/decompress
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498814
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-39245
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-39245
  • article
    https://github.com/kevva/decompress/issues/115
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-12265
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498118
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59725
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59725
  • article
    https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671
  • article
    https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7
  • article
    https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498122
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59869
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59869
  • article
    https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
  • article
    https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
  • article
    https://github.com/nodeca/js-yaml/releases/tag/3.15.0
  • article
    https://github.com/nodeca/js-yaml/releases/tag/4.3.0
  • article
    https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m