Skip to content
OpenAdvisories
Medium RHSA-2026:40223 1 CVE

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jul 16, 2026 · Updated Oct 10, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 caddy 0:2.11.4-0.2.hum1

Vulnerabilities 1

  • Medium 5.3
    CVE-2026-40898

    quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

    quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large traile…

    quic-go quic-go k3s k3s-static Debian Ubuntu Wolfi Go

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-40898
  • article
    https://access.redhat.com/security/updates/classification/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40223.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2484875
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-40898
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-40898
  • article
    https://github.com/quic-go/quic-go/releases/tag/v0.59.1
  • article
    https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9