Skip to content
OpenAdvisories
High RHSA-2026:63160 12 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 9, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 39

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 erlang27 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-asn1 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-common_test 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-compiler 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-crypto 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-debugger 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-dialyzer 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-diameter 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-edoc 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-eldap 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-erl_interface 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-erts 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-et 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-eunit 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-examples 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-ftp 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-gdb-tools 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-inets 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-jinterface 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-kernel 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-megaco 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-mnesia 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-observer 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-odbc 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-os_mon 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-parsetools 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-public_key 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-reltool 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-runtime_tools 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-sasl 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-snmp 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-ssh 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-ssl 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-stdlib 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-syntax_tools 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-tftp 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-tools 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-wx 0:27.3.4.17-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 erlang27-xmerl 0:27.3.4.17-1.hum1

Vulnerabilities 12

  • High 8.8
    CVE-2026-49759

    Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash

    Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk. The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-55952

    TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension

    The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tls_handshake_1_3:handle_pre_shared_k…

    Erlang Project OTP erlang erlang Debian Ubuntu
  • High 8.2
    CVE-2026-75538

    A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer

    An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 7.6
    CVE-2026-42790

    nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

    Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-48860

    Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist

    Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distrib…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2026-42789

    Non-CA certificate accepted as intermediate issuer in public_key path validation

    Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, p…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-42791

    OCSP responder certificate validity period not checked in public_key

    Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. OCSP response verification in pubkey_ocsp:verify_response/5 and pubk…

    Erlang Project OTP erlang erlang Debian Ubuntu
  • Medium 6.3
    CVE-2026-48858

    ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks

    Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address. The ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_exten…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-54891

    Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl

    Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later…

    Erlang Project OTP erlang erlang Debian Ubuntu
  • Medium 6.3
    CVE-2026-70405

    snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

    Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmp_pdus:dec_integer_notag/1 def…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-54886

    SSH SFTP server denial of service via extended channel data infinite loop

    Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handle_data/4 function in ssh_sftpd contains a catch-all clause…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • Low 2.3
    CVE-2026-48855

    SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filena…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-75538
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-70405
  • report
    https://access.redhat.com/security/cve/CVE-2026-55952
  • report
    https://access.redhat.com/security/cve/CVE-2026-54891
  • report
    https://access.redhat.com/security/cve/CVE-2026-54886
  • report
    https://access.redhat.com/security/cve/CVE-2026-48860
  • report
    https://access.redhat.com/security/cve/CVE-2026-48858
  • report
    https://access.redhat.com/security/cve/CVE-2026-48855
  • report
    https://access.redhat.com/security/cve/CVE-2026-42791
  • report
    https://access.redhat.com/security/cve/CVE-2026-42790
  • report
    https://access.redhat.com/security/cve/CVE-2026-42789
  • report
    https://access.redhat.com/security/cve/CVE-2026-49759
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63160.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482093
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42789
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42789
  • article
    https://cna.erlef.org/cves/CVE-2026-42789.html
  • article
    https://github.com/erlang/otp/commit/471cd2f664300a95353c467873800bbe706005db
  • article
    https://github.com/erlang/otp/commit/59c8d824386b2eb1614ff9340624843ef6aca0fd
  • article
    https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-42789
  • article
    https://www.erlang.org/doc/system/versions.html#order-of-versions
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482286
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42790
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42790
  • article
    https://cna.erlef.org/cves/CVE-2026-42790.html
  • article
    https://github.com/erlang/otp/commit/0769050c69d73762672b0db1347b6993a5b31759
  • article
    https://github.com/erlang/otp/commit/21abed64eb2026b5f82f432709e4e932f9be389a
  • article
    https://github.com/erlang/otp/commit/fb67c6d1836f51105a96d8b769e71e4215a79457
  • article
    https://github.com/erlang/otp/security/advisories/GHSA-22cw-4ph4-6447
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-42790
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481950
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42791
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42791
  • article
    https://cna.erlef.org/cves/CVE-2026-42791.html
  • article
    https://github.com/erlang/otp/commit/7995f1fdaee3da569bb810358ce0f546471d169b
  • article
    https://github.com/erlang/otp/commit/b3870e02405c709a872b01ba6086065620cdfe76