Skip to content
OpenAdvisories
High RHSA-2026:67595 1 CVE

Red Hat Security Advisory: goose bug fix and enhancement update

Published Sep 16, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::extensions goose 0:1.38.0-1.el9_8
Red Hat · RHEL 9 enterprise_linux:9::extensions goose-debuginfo 0:1.38.0-1.el9_8
Red Hat · RHEL 9 enterprise_linux:9::extensions goose-debugsource 0:1.38.0-1.el9_8

Vulnerabilities 1

  • High 7.5
    CVE-2026-18140

    Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

    Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service …

    AWS aws-smithy-json zed pixi Wolfi crates.io

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67595.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-18140
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509566
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-18140
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-18140
  • article
    https://aws.amazon.com/security/security-bulletins/2026-067-aws/
  • article
    https://crates.io/crates/aws-smithy-json/0.62.7
  • article
    https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-8ffr-xgwf-xj56