Skip to content
OpenAdvisories
Critical RHSA-2026:47009 5 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jul 30, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 39

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 erlang27 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-asn1 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-common_test 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-compiler 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-crypto 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-debugger 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-dialyzer 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-diameter 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-edoc 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-eldap 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-erl_interface 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-erts 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-et 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-eunit 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-examples 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-ftp 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-gdb-tools 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-inets 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-jinterface 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-kernel 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-megaco 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-mnesia 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-observer 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-odbc 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-os_mon 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-parsetools 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-public_key 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-reltool 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-runtime_tools 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-sasl 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-snmp 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-ssh 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-ssl 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-stdlib 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-syntax_tools 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-tftp 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-tools 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-wx 0:27.3.4.15-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-xmerl 0:27.3.4.15-0.1.hum1

Vulnerabilities 5

  • Critical 9.1
    CVE-2026-55953

    TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

    The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotia…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-59251

    Denial of service via exponential certificate policy tree growth in path validation

    Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy proce…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.3
    CVE-2026-59250

    Megaco flex scanner buffer overflow via oversized property parm name

    Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-54890

    BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

    Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.…

    Erlang Project OTP erlang erlang Debian Ubuntu
  • Medium 6.3
    CVE-2026-42792

    epmd permanent DoS via EMFILE on accept(2) in erts

    Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-59251
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-42792
  • report
    https://access.redhat.com/security/cve/CVE-2026-55953
  • report
    https://access.redhat.com/security/cve/CVE-2026-59250
  • report
    https://access.redhat.com/security/cve/CVE-2026-54890
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47009.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507551
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42792
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42792
  • article
    https://cna.erlef.org/cves/CVE-2026-42792.html
  • article
    https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb
  • article
    https://github.com/erlang/otp/security/advisories/GHSA-h6f3-hx58-xhj6
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-42792
  • article
    https://www.erlang.org/doc/system/versions.html#order-of-versions
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507571
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-54890
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-54890
  • article
    https://cna.erlef.org/cves/CVE-2026-54890.html
  • article
    https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd
  • article
    https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-54890
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507558
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55953
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55953
  • article
    https://cna.erlef.org/cves/CVE-2026-55953.html
  • article
    https://github.com/erlang/otp/commit/064e236414614f9085cbbbd6eacf0e43c02d1b4b
  • article
    https://github.com/erlang/otp/commit/0a82596d425abe43dc2e0b3d74aa1557ef74051c
  • article
    https://github.com/erlang/otp/commit/e6ff938116b2872bccc478af7fefb56627285b77
  • article
    https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-55953
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507559
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59250
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59250
  • article
    https://cna.erlef.org/cves/CVE-2026-59250.html
  • article
    https://github.com/erlang/otp/commit/8704c8f550a11ed5f825e3c011ecb03565b79c4f
  • article
    https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-59250