Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 44

Vulnerabilities 4

• High 8.9
  CVE-2026-44432

  urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

  urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Br…

  urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Wolfi PyPI
  May 13, 2026
• Medium 6.5
  CVE-2026-45149

  brace-expansion: Large numeric range defeats documented `max` DoS protection

  The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop …

  juliangruber brace-expansion langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  May 29, 2026
• Low 3.3
  CVE-2026-13573

  llvm llvm-project ValueSymbolTable ValueSymbolTable.cpp insert stack-based overflow

  A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulation results in stack-based buffer overflow. Attac…

  llvm llvm-project llvm-toolchain-18 llvm-toolchain-19 Debian Ubuntu
  Jun 29, 2026
• Low 3.3
  CVE-2026-13574

  llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow

  A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It …

  llvm llvm-project llvm-toolchain-18 llvm-toolchain-19 Debian Ubuntu
  Jun 29, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-45149
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-44432
• report
  https://access.redhat.com/security/cve/CVE-2026-13573
• report
  https://access.redhat.com/security/cve/CVE-2026-13574
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7634.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494424
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-13573
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-13573
• article
  https://github.com/llvm/llvm-project/
• article
  https://github.com/llvm/llvm-project/issues/199187
• article
  https://github.com/user-attachments/files/28141697/poc.zip
• article
  https://vuldb.com/cve/CVE-2026-13573
• article
  https://vuldb.com/submit/844457
• article
  https://vuldb.com/vuln/374581
• article
  https://vuldb.com/vuln/374581/cti
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494420
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-13574
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-13574
• article
  https://github.com/llvm/llvm-project/issues/199191
• article
  https://github.com/user-attachments/files/28142619/poc.zip
• article
  https://vuldb.com/cve/CVE-2026-13574
• article
  https://vuldb.com/submit/844468
• article
  https://vuldb.com/vuln/374582
• article
  https://vuldb.com/vuln/374582/cti
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477154
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-44432
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-44432
• article
  https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483481
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45149
• article
  https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2