Skip to content
OpenAdvisories
High RHSA-2026:62531 8 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 3, 2026 · Updated Oct 2, 2026

Ecosystem: Red Hat

Fixed packages 39

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 erlang27 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-asn1 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-common_test 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-compiler 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-crypto 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-debugger 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-dialyzer 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-diameter 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-edoc 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-eldap 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-erl_interface 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-erts 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-et 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-eunit 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-examples 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-ftp 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-gdb-tools 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-inets 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-jinterface 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-kernel 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-megaco 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-mnesia 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-observer 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-odbc 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-os_mon 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-parsetools 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-public_key 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-reltool 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-runtime_tools 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-sasl 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-snmp 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-ssh 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-ssl 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-stdlib 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-syntax_tools 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-tftp 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-tools 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-wx 0:27.3.4.17-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-xmerl 0:27.3.4.17-0.1.hum1

Vulnerabilities 8

  • High 8.7
    CVE-2026-69664

    httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

    Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The w…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-70399

    httpd does not enforce the documented default max_clients connection limit

    Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented t…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-74835

    inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

    The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.3
    CVE-2026-73812

    inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

    httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length.…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-66835

    httpd mod_auth directory protection bypassed by a doubled slash in the request path

    Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash. httpd_request:validate_uri/1 normalises the request URI wi…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-73270

    httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

    Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insens…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-70409

    eldap does not bound the port component of a referral URL before integer conversion

    Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parse_port/2 passes…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • Medium 6.0
    CVE-2026-74994

    inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

    The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected d…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-74835
  • report
    https://access.redhat.com/security/cve/CVE-2026-70399
  • report
    https://access.redhat.com/security/cve/CVE-2026-66835
  • report
    https://access.redhat.com/security/cve/CVE-2026-74994
  • report
    https://access.redhat.com/security/cve/CVE-2026-70409
  • report
    https://access.redhat.com/security/cve/CVE-2026-73270
  • report
    https://access.redhat.com/security/cve/CVE-2026-73812
  • article
    https://images.redhat.com/
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-69664
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62531.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2526849
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-66835
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-66835
  • article
    https://cna.erlef.org/cves/CVE-2026-66835.html
  • article
    https://github.com/erlang/otp/commit/9641944a2efbf55bea760f8ff7ba777fe3a0961c
  • article
    https://github.com/erlang/otp/commit/bac19eb3dbd96cc49b6d8cabc1c04248bf8c79f6
  • article
    https://github.com/erlang/otp/commit/d8878dec0ececc2eab18e47bb18b472f224ca633
  • article
    https://github.com/erlang/otp/security/advisories/GHSA-r4vv-vc2c-2fw6
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-66835
  • article
    https://www.erlang.org/doc/system/versions.html#order-of-versions
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2526864
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-69664
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-69664
  • article
    https://cna.erlef.org/cves/CVE-2026-69664.html
  • article
    https://github.com/erlang/otp/commit/a3adf63078438c86527d704e23282b7721d8ca12
  • article
    https://github.com/erlang/otp/commit/bd4e74348c6be8a49f060da6fd48d43f3a960292
  • article
    https://github.com/erlang/otp/commit/df1a9ca4666e2fdfc44886bfaae76de086d803f6
  • article
    https://github.com/erlang/otp/security/advisories/GHSA-mr35-8h7w-w3gq
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-69664
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2526832
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-70399
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-70399
  • article
    https://cna.erlef.org/cves/CVE-2026-70399.html
  • article
    https://github.com/erlang/otp/commit/6746dc4e1df5257ad8ac91cbbd167cb8b0274ce7
  • article
    https://github.com/erlang/otp/commit/d94a94c96eb4cccbd6f7d7da5975f0c035b69612
  • article
    https://github.com/erlang/otp/commit/e0050fc00c500a4fa9ba1f594603c787ff6d20b2
  • article
    https://github.com/erlang/otp/security/advisories/GHSA-pwvh-c689-f8q5
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-70399