Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 1

Vulnerabilities 2

• High 7.5
  CVE-2026-42127

  Pre-authentication denial of service in the public dashboard query endpoint

  The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exh…

  Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine Wolfi Go
  Jun 22, 2026
• Low 3.7
  CVE-2026-56764

  Hono - Timing Attack in basicAuth and bearerAuth Middleware

  Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid…

  Hono Hono hono npm
  Jul 15, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-56764
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-42127
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47618.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491449
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42127
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42127
• article
  https://grafana.com/security/security-advisories/cve-2026-42127
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2500893
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-56764
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-56764
• article
  https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf
• article
  https://www.vulncheck.com/advisories/hono-timing-attack-in-basicauth-and-bearerauth-middleware