Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 1

Vulnerabilities 3

• High 8.7
  CVE-2026-73500

  etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

  etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/…

  etcd-io etcd kots kyverno-1.17 Debian Ubuntu Azure Linux Wolfi Go
  Aug 12, 2026
• Medium 6.5
  CVE-2026-59818

  etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation

  etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate R…

  etcd-io etcd etcd etcd Debian Ubuntu Azure Linux
  Jul 8, 2026
• None 0.0
  CVE-2026-44283

  etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks

  etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authoriza…

  etcd-io etcd juicefs-1.3 dapr-scheduler-1.17 Debian Ubuntu Azure Linux Wolfi Go
  May 14, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-73500
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-59818
• report
  https://access.redhat.com/security/cve/CVE-2026-44283
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_44868.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477527
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-44283
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-44283
• article
  https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498305
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59818
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59818
• article
  https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef
• article
  https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f
• article
  https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb
• article
  https://github.com/etcd-io/etcd/pull/22007
• article
  https://github.com/etcd-io/etcd/pull/22021
• article
  https://github.com/etcd-io/etcd/pull/22025
• article
  https://github.com/etcd-io/etcd/releases/tag/v3.5.32
• article
  https://github.com/etcd-io/etcd/releases/tag/v3.6.13
• article
  https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515007
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-73500
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-73500
• article
  https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2
• article
  https://github.com/etcd-io/etcd/commit/89ff6d50796049d4f1136915ba21504b76e7e372
• article
  https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3
• article
  https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057
• article
  https://github.com/etcd-io/etcd/pull/22130
• article
  https://github.com/etcd-io/etcd/releases/tag/v3.5.33
• article
  https://github.com/etcd-io/etcd/releases/tag/v3.6.14
• article
  https://github.com/etcd-io/etcd/releases/tag/v3.7.1
• article
  https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3