Red Hat Security Advisory: Satellite 6.19.3 Async Update

Fixed packages 17

Vulnerabilities 8

• High 7.5
  CVE-2026-54059

  Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF fo…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026
• High 7.5
  CVE-2026-54060

  Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessi…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026
• High 7.5
  CVE-2026-54297

  Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

  Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query stri…

  lostisland faraday logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Wolfi RubyGems
  Jun 24, 2026
• High 7.5
  CVE-2026-55379

  Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing P…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026
• High 7.5
  CVE-2026-55380

  Pillow GdImageFile decompression bomb protection bypass

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger ex…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026
• High 7.4
  CVE-2026-2332 Public exploit

  HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

  In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.htm…

  Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven
  Apr 14, 2026
• Medium 4.3
  CVE-2026-12515

  Katello: missing repository authorization in content_uploads exposes cross-product content existence

  A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside th…

  Red Hat Red Hat Hardened Images Red Hat Satellite 6 Red Hat Satellite 6.16 for RHEL 8 RubyGems
  Jun 17, 2026
• Low 1.7
  CVE-2026-57236

  Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

  Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the do…

  sparklemotion nokogiri nokogiri ruby-nokogiri Debian Ubuntu Azure Linux Alpine RubyGems
  Jun 25, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://issues.redhat.com/browse/SAT-42697
• article
  https://issues.redhat.com/browse/SAT-47597
• article
  https://issues.redhat.com/browse/SAT-47598
• article
  https://issues.redhat.com/browse/SAT-47599
• article
  https://issues.redhat.com/browse/SAT-47601
• article
  https://issues.redhat.com/browse/SAT-47602
• article
  https://issues.redhat.com/browse/SAT-47604
• article
  https://issues.redhat.com/browse/SAT-47605
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50221.json
• report
  https://access.redhat.com/security/cve/CVE-2026-2332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458187
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-2332
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-2332
• article
  https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf
• article
  https://gitlab.eclipse.org/security/cve-assignment/-/issues/89
• report
  https://access.redhat.com/security/cve/CVE-2026-12515
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2489812
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-12515
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-12515
• article
  https://github.com/Katello/katello/pull/11712
• report
  https://access.redhat.com/security/cve/CVE-2026-54059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497464
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-54059
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-54059
• article
  https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
• article
  https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
• article
  https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x
• report
  https://access.redhat.com/security/cve/CVE-2026-54060
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497466
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-54060
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-54060
• article
  https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2
• report
  https://access.redhat.com/security/cve/CVE-2026-54297
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492252
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-54297
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-54297
• article
  https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r
• report
  https://access.redhat.com/security/cve/CVE-2026-55379