Skip to content
OpenAdvisories
Critical RHSA-2026:62790 19 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 22, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 ruby3.4 0:3.4.10-31.7.hum1
Red Hat · Hardened Images 1 hummingbird:1 ruby3.4-bundled-gems 0:3.4.10-31.7.hum1
Red Hat · Hardened Images 1 hummingbird:1 ruby3.4-default-gems 0:3.4.10-31.7.hum1
Red Hat · Hardened Images 1 hummingbird:1 ruby3.4-devel 0:3.4.10-31.7.hum1
Red Hat · Hardened Images 1 hummingbird:1 ruby3.4-doc 0:3.4.10-31.7.hum1
Red Hat · Hardened Images 1 hummingbird:1 ruby3.4-libs 0:3.4.10-31.7.hum1

Vulnerabilities 19

  • Critical 9.1
    CVE-2026-34182

    CMS AuthEnvelopedData Processing May Accept Forged Messages

    Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-45447 Public exploit

    Heap Use-After-Free in the PKCS7_verify() Function

    Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.2
    CVE-2026-84782

    DTLS Retransmits Handshake Messages From a Stale Buffer Offset

    Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspend…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.1
    CVE-2026-7383

    Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion

    Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code executi…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-34180

    Heap Buffer Over-read in ASN.1 Content Parsing

    Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-34183

    Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

    Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termin…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-42764

    NULL Pointer Dereference in QUIC Server Initial Packet Handling

    Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affe…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • High 7.5
    CVE-2026-42765

    NULL Dereference in Certificate Verification with OCSP Checking

    Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact sum…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Wolfi
  • High 7.5
    CVE-2026-45445

    AES-OCB IV Ignored on EVP_Cipher() Path

    Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the sam…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-9076

    Out-of-Bounds Read in CMS Password-Based Decryption

    Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read m…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-34181

    PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys

    Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker im…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • Medium 6.2
    CVE-2026-42771

    Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()

    Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen. Impact summary: This out of bounds read will not directly exfilt…

    OpenSSL OpenSSL nodejs openssl-4.0-libssl Ubuntu Wolfi
  • Medium 5.9
    CVE-2026-42766

    Possible NULL Dereference in Password-Based CMS Decryption

    Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-42767

    NULL Pointer Dereference in CRMF EncryptedValue Decryption

    Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An a…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2026-42769

    Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate

    Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.0
    CVE-2026-35188

    Double-free When Checking OCSP Stapled Response

    Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an at…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Wolfi
  • Medium 4.8
    CVE-2026-45446

    Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

    Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty m…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.7
    CVE-2026-42768

    Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()

    Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-sty…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.7
    CVE-2026-42770

    FFC-DH Peer Validation Uses Attacker-Supplied q

    Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a fo…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-34181
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-42769
  • report
    https://access.redhat.com/security/cve/CVE-2026-42768
  • report
    https://access.redhat.com/security/cve/CVE-2026-34180
  • report
    https://access.redhat.com/security/cve/CVE-2026-7383
  • report
    https://access.redhat.com/security/cve/CVE-2026-45447
  • report
    https://access.redhat.com/security/cve/CVE-2026-42766
  • report
    https://access.redhat.com/security/cve/CVE-2026-45446
  • report
    https://access.redhat.com/security/cve/CVE-2026-34182
  • report
    https://access.redhat.com/security/cve/CVE-2026-42767
  • report
    https://access.redhat.com/security/cve/CVE-2026-45445
  • report
    https://access.redhat.com/security/cve/CVE-2026-9076
  • report
    https://access.redhat.com/security/cve/CVE-2026-42765
  • report
    https://access.redhat.com/security/cve/CVE-2026-42771
  • report
    https://access.redhat.com/security/cve/CVE-2026-35188
  • report
    https://access.redhat.com/security/cve/CVE-2026-42770
  • report
    https://access.redhat.com/security/cve/CVE-2026-42764
  • report
    https://access.redhat.com/security/cve/CVE-2026-34183
  • report
    https://access.redhat.com/security/cve/CVE-2026-84782
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62790.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481879
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-7383
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-7383
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481880
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-9076
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-9076
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481881
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34180
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34180
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481882
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34181
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34181
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481884
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34182
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34182
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481885
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34183