Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 3

Vulnerabilities 3

• Medium 6.9
  CVE-2026-56404

  libexpat before 2.8.2 has an integer overflow in addBinding.

  libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 21, 2026
• Medium 6.9
  CVE-2026-56407

  libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.

  libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 21, 2026
• Medium 4.9
  CVE-2026-56131

  libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of …

  libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 19, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-56407
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-56404
• report
  https://access.redhat.com/security/cve/CVE-2026-56131
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40486.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2490668
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-56131
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-56131
• article
  https://github.com/libexpat/libexpat/pull/1267
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491185
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-56404
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-56404
• article
  https://github.com/libexpat/libexpat/pull/1249
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491184
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-56407
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-56407
• article
  https://github.com/libexpat/libexpat/pull/1262