Skip to content
OpenAdvisories
High RHSA-2026:42045 1 CVE

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Aug 19, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 jaeger 0:2.19.0-1.2.hum1

Vulnerabilities 1

  • High 8.7
    CVE-2026-49852

    joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty st…

    authlib joserfc airflow-3 joserfc Debian Ubuntu Wolfi PyPI

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-49852
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42045.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2501881
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49852
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49852
  • article
    https://github.com/authlib/joserfc/commit/86d00910b2b2d2d07503fee9b572906daefab7f1
  • article
    https://github.com/authlib/joserfc/releases/tag/1.6.8
  • article
    https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh