Skip to content
OpenAdvisories
High RHSA-2026:80677 5 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Oct 14, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 hugo 0:0.167.0-0.2.hum1

Vulnerabilities 5

  • High 7.5
    CVE-2024-24786

    Infinite loop in JSON unmarshaling in google.golang.org/protobuf

    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown opti…

    google.golang.org/protobuf google.golang.org/protobuf/encoding/protojson google.golang.org/protobuf/internal/encoding/json katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.5
    CVE-2026-109574

    Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback

    Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or sym…

    gohugoio hugo hugo hugo Debian Ubuntu
  • Medium 5.5
    CVE-2026-109595

    Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver

    Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports …

    gohugoio hugo hugo hugo Debian Ubuntu
  • Medium 5.5
    CVE-2026-109596

    Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor

    Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS juncti…

    gohugoio hugo hugo hugo Debian Ubuntu
  • Medium 5.4
    CVE-2026-109597

    Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs

    Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents o…

    gohugoio hugo hugo hugo Debian Ubuntu

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2024-24786
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-109596
  • report
    https://access.redhat.com/security/cve/CVE-2026-109595
  • report
    https://access.redhat.com/security/cve/CVE-2026-109574
  • report
    https://access.redhat.com/security/cve/CVE-2026-109597
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80677.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268046
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-24786
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-24786
  • article
    https://go.dev/cl/569356
  • article
    https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/
  • advisory
    https://pkg.go.dev/vuln/GO-2024-2611
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550039
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109574
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109574
  • article
    https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf
  • article
    https://www.vulncheck.com/advisories/hugo-before-0.167.0-path-traversal-via-css-sass-import-fallback
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550056
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109595
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109595
  • article
    https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424
  • article
    https://www.vulncheck.com/advisories/hugo-0.84.0-before-0.167.0-path-traversal-via-js-build-esbuild-resolver
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550016
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109596
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109596
  • article
    https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47
  • article
    https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550088
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109597
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109597
  • article
    https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg
  • article
    https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids