Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 1

Vulnerabilities 8

• High 7.5
  CVE-2024-24786

  Infinite loop in JSON unmarshaling in google.golang.org/protobuf

  The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown opti…

  google.golang.org/protobuf google.golang.org/protobuf/internal/encoding/json google.golang.org/protobuf/encoding/protojson katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• High 7.5
  CVE-2026-56851

  Panic parsing crafted input in x/text/secure/precis in golang.org/x/text

  The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

  golang.org/x/text golang.org/x/text/secure/precis renovate trino Debian Ubuntu Azure Linux Wolfi Go
  Oct 7, 2026
• High 7.5
  CVE-2026-97394

  kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

  kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or …

  getkin kin-openapi github.com/getkin/kin-openapi golang-github-getkin-kin-openapi Ubuntu Go
  Oct 15, 2026
• Medium 6.9
  CVE-2026-101899

  Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

  Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a C…

  axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  Oct 13, 2026
• Medium 5.5
  CVE-2026-61801

  github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

  The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allow…

  moby sys zarf k3d Debian Ubuntu Azure Linux Wolfi Go
  Oct 8, 2026
• Medium 5.4
  CVE-2026-13720

  Editor can forge file-provisioning provenance on dashboards via the dashboard API

  An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The da…

  Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  Sep 30, 2026
• Medium 5.3
  CVE-2026-81841

  Paused shared dashboard access tokens still expose data source configuration

  Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's d…

  Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  Sep 29, 2026
• Medium 4.3
  CVE-2026-13719

  Alert rules in restricted folders disclosed via the alert rules list API

  An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organizati…

  Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  Sep 30, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-13720
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-13719
• report
  https://access.redhat.com/security/cve/CVE-2026-81841
• report
  https://access.redhat.com/security/cve/CVE-2026-56851
• report
  https://access.redhat.com/security/cve/CVE-2026-61801
• report
  https://access.redhat.com/security/cve/CVE-2024-24786
• report
  https://access.redhat.com/security/cve/CVE-2026-101899
• report
  https://access.redhat.com/security/cve/CVE-2026-97394
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76448.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268046
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24786
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24786
• article
  https://go.dev/cl/569356
• article
  https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/
• advisory
  https://pkg.go.dev/vuln/GO-2024-2611
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543885
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-13719
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-13719
• article
  https://grafana.com/security/security-advisories/cve-2026-13719
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543886
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-13720
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-13720
• article
  https://grafana.com/security/security-advisories/cve-2026-13720
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2547607
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-56851
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-56851
• article
  https://go.dev/cl/793360
• article
  https://go.dev/issue/80112
• advisory
  https://pkg.go.dev/vuln/GO-2026-6629
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548048
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-61801
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-61801
• article
  https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe
• article
  https://github.com/moby/sys/pull/221
• article
  https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543644
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-81841