Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 6

Vulnerabilities 9

• Critical 9.3
  CVE-2026-55971

  Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

  Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu Azure Linux
  Jul 27, 2026
• High 8.7
  CVE-2026-43871

  Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

  Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift druid minio Debian Ubuntu Azure Linux Wolfi Packagist Maven PyPI Go
  Jul 27, 2026
• High 8.7
  CVE-2026-55968

  Apache Thrift: Node.js quadratic-time DoS in server receive transports

  Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issu…

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu
  Jul 27, 2026
• High 7.5
  CVE-2026-41608

  Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport

  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu Azure Linux PyPI
  Jul 27, 2026
• High 7.5
  CVE-2026-49158

  Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb

  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift ruby-thrift Debian Ubuntu
  Jul 27, 2026
• Medium 6.9
  CVE-2026-45112

  Apache Thrift: Unbounded Read Leading to Denial of Service

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift libthrift-java Debian Ubuntu
  Jul 27, 2026
• Medium 6.9
  CVE-2026-55970

  Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()

  Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu Azure Linux
  Jul 27, 2026
• Medium 6.9
  CVE-2026-58023

  Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path

  Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu Azure Linux
  Jul 27, 2026
• Medium 5.9
  CVE-2026-66053

  Apache Thrift: Python TSSLSocket Hostname Matcher Import

  Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu Azure Linux PyPI
  Jul 27, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-41608
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-66053
• report
  https://access.redhat.com/security/cve/CVE-2026-58023
• report
  https://access.redhat.com/security/cve/CVE-2026-55970
• report
  https://access.redhat.com/security/cve/CVE-2026-55968
• report
  https://access.redhat.com/security/cve/CVE-2026-45112
• report
  https://access.redhat.com/security/cve/CVE-2026-49158
• report
  https://access.redhat.com/security/cve/CVE-2026-43871
• report
  https://access.redhat.com/security/cve/CVE-2026-55971
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49837.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507442
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41608
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41608
• article
  http://www.openwall.com/lists/oss-security/2026/07/24/32
• article
  https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
• article
  https://lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6rodbfm21f
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507441
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43871
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43871
• article
  http://www.openwall.com/lists/oss-security/2026/07/24/33
• article
  https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507439
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45112
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45112
• article
  http://www.openwall.com/lists/oss-security/2026/07/24/34
• article
  https://lists.apache.org/thread/hl9kmf1z2o3lxvspoj3g9ykl8lj9mdxc
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507435
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-49158
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-49158
• article
  http://www.openwall.com/lists/oss-security/2026/07/24/38
• article
  https://lists.apache.org/thread/fmjl8l415tj9zwlob8v2dr5hq1d0hts7
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507437
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55968
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55968
• article
  http://www.openwall.com/lists/oss-security/2026/07/24/39
• article
  https://lists.apache.org/thread/gxhhfyr6flr5vzr4qnxm13p6fc41qstp
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507438