Skip to content
OpenAdvisories
Critical RHSA-2026:40415 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Jul 16, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 aspnetcore-runtime-8.0 0:8.0.28-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 aspnetcore-runtime-dbg-8.0 0:8.0.28-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 aspnetcore-targeting-pack-8.0 0:8.0.28-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-apphost-pack-8.0 0:8.0.28-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-hostfxr-8.0 0:8.0.28-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-runtime-8.0 0:8.0.28-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-runtime-dbg-8.0 0:8.0.28-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-sdk-8.0 0:8.0.128-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-sdk-8.0-source-built-artifacts 0:8.0.128-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-sdk-dbg-8.0 0:8.0.128-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-targeting-pack-8.0 0:8.0.28-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet-templates-8.0 0:8.0.128-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 dotnet8.0 0:8.0.128-1.2.hum1

Vulnerabilities 2

  • Critical 9.1
    CVE-2026-53486

    decompress: Archive extraction can create files and links outside the target directory

    The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that dir…

    XhmikosR decompress decompress @xhmikosr/decompress npm
  • High 7.5
    CVE-2026-59869

    js-yaml: YAML merge-key chains can force quadratic CPU consumption

    js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

    nodeca js-yaml katib-suggestion-hyperopt prism Debian Ubuntu Azure Linux Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-53486
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-59869
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40415.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500679
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53486
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53486
  • article
    https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd
  • article
    https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae
  • article
    https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89
  • article
    https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd
  • article
    https://github.com/XhmikosR/decompress/releases/tag/v10.2.1
  • article
    https://github.com/XhmikosR/decompress/releases/tag/v11.1.3
  • article
    https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498122
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59869
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59869
  • article
    https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
  • article
    https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
  • article
    https://github.com/nodeca/js-yaml/releases/tag/3.15.0
  • article
    https://github.com/nodeca/js-yaml/releases/tag/4.3.0
  • article
    https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m