Skip to content
OpenAdvisories
Critical RHSA-2026:63514 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 22, 2026 · Updated Sep 23, 2026

Ecosystem: Red Hat

Fixed packages 19

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 cargo 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 clippy 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-analyzer 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-debugger-common 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-doc 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-gdb 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-lldb 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-src 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-std-static 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-std-static-aarch64-unknown-none-softfloat 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-std-static-aarch64-unknown-uefi 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-std-static-i686-pc-windows-gnu 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-std-static-wasm32-unknown-unknown 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-std-static-wasm32-wasip1 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-std-static-x86_64-pc-windows-gnu 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-std-static-x86_64-unknown-none 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rust-std-static-x86_64-unknown-uefi 0:1.98.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 rustfmt 0:1.98.0-1.hum1

Vulnerabilities 3

  • Critical 9.8
    CVE-2026-19931

    Negotiate ambient user conn reuse

    A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated con…

    curl curl mysql curl Debian Azure Linux Alpine Wolfi
  • Critical 9.1
    CVE-2026-18924

    HTTP/2 server push UAF

    A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-13608

    OpenLDAP SASL authentication bypass

    A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut …

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-19931
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-13608
  • report
    https://access.redhat.com/security/cve/CVE-2026-18924
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63514.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2529198
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-13608
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-13608
  • article
    https://curl.se/docs/CVE-2026-13608.html
  • article
    https://curl.se/docs/CVE-2026-13608.json
  • article
    https://hackerone.com/reports/3822248
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2529201
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-18924
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-18924
  • article
    https://curl.se/docs/CVE-2026-18924.html
  • article
    https://curl.se/docs/CVE-2026-18924.json
  • article
    https://hackerone.com/reports/3916059
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2529199
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19931
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19931
  • article
    https://curl.se/docs/CVE-2026-19931.html
  • article
    https://curl.se/docs/CVE-2026-19931.json
  • article
    https://hackerone.com/reports/3923520