Skip to content
OpenAdvisories
Critical RHSA-2026:63387 9 CVEs

Red Hat Security Advisory: Satellite 6.17.11 Async Update

Published Sep 4, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 18

ReleasePackageFixed in
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 ansible-core 1:2.16.19-1.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 ansible-test 1:2.16.19-1.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 openvox-server 0:8.15.2-1.el9sat
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 python-aiohttp 0:3.14.3-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 python-aiohttp-debugsource 0:3.14.3-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 python3.11-aiohttp 0:3.14.3-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 python3.11-aiohttp-debuginfo 0:3.14.3-1.el9pc
Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 rubygem-jwt 0:2.10.3-1.el9sat
Red Hat · Satellite Maintenance 6 satellite_maintenance:6.17::el9 ansible-core 1:2.16.19-1.el9sat
Red Hat · Satellite Utils 6 satellite_utils:6.17::el9 rubygem-jwt 0:2.10.3-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 ansible-core 1:2.16.19-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 ansible-test 1:2.16.19-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 openvox-server 0:8.15.2-1.el9sat
Red Hat · Satellite 6 satellite:6.17::el9 python-aiohttp 0:3.14.3-1.el9pc
Red Hat · Satellite 6 satellite:6.17::el9 python-aiohttp-debugsource 0:3.14.3-1.el9pc
Red Hat · Satellite 6 satellite:6.17::el9 python3.11-aiohttp 0:3.14.3-1.el9pc
Red Hat · Satellite 6 satellite:6.17::el9 python3.11-aiohttp-debuginfo 0:3.14.3-1.el9pc
Red Hat · Satellite 6 satellite:6.17::el9 rubygem-jwt 0:2.10.3-1.el9sat

Vulnerabilities 9

  • Critical 9.1
    CVE-2026-45363

    `jwt` (Ruby gem) - empty-key HMAC bypass

    ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid di…

    jwt ruby-jwt kube-fluentd-operator ruby3.4-kube-logging-operator-fluentd-outputs Debian Ubuntu Wolfi RubyGems
  • High 8.7
    CVE-2026-68494

    jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

    The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into …

    FasterXML jackson-core druid trino Ubuntu Wolfi Maven
  • High 8.1
    CVE-2026-54512 Public exploit

    jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.8
    CVE-2026-11332

    Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

    A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git con…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux PyPI
  • High 7.8
    CVE-2026-16493

    Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

    A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-69244

    AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possib…

    aio-libs aiohttp open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 6.9
    CVE-2026-10051

    Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

    In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent requ…

    Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven
  • Medium 6.4
    CVE-2026-34993

    AIOHTTP Vulnerable to Deserialization of Untrusted Data

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's…

    aio-libs aiohttp open-webui katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 6.3
    CVE-2026-69243 Public exploit

    AIOHTTP: HTTP request smuggling via WebSocket upgrade

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to exec…

    aio-libs aiohttp open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2484099
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2485379
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492015
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499928
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500739
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2503724
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510825
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510831
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511026
  • article
    https://issues.redhat.com/browse/SAT-42127
  • article
    https://issues.redhat.com/browse/SAT-45924
  • article
    https://issues.redhat.com/browse/SAT-48680
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63387.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-10051
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-10051
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-10051
  • article
    https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119
  • report
    https://access.redhat.com/security/cve/CVE-2026-11332
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-11332
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-11332
  • article
    https://github.com/ansible/ansible
  • report
    https://access.redhat.com/security/cve/CVE-2026-16493
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-16493
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-16493
  • report
    https://access.redhat.com/security/cve/CVE-2026-34993
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34993
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34993
  • article
    https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
  • article
    https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8
  • report
    https://access.redhat.com/security/cve/CVE-2026-45363
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45363
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45363
  • article
    https://github.com/jwt/ruby-jwt/commit/9820020869ad147b941e49d96ab8beba35532964
  • article
    https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f
  • article
    https://github.com/jwt/ruby-jwt/releases/tag/v2.10.3
  • article
    https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0
  • article
    https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x
  • report
    https://access.redhat.com/security/cve/CVE-2026-54512