Skip to content
OpenAdvisories
High RHSA-2026:8165 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Apr 20, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 composer 0:2.9.7-1.hum1

Vulnerabilities 3

  • High 8.8
    CVE-2026-40261 Public exploit

    Composer has Command Injection via Malicious Perforce Reference

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escapi…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist
  • High 7.8
    CVE-2026-40176 Public exploit

    Composer is vulnerable to Command Injection via Malicious Perforce Repository

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connecti…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist
  • Low 1.3
    CVE-2025-67746

    Composer vulnerable to ANSI sequence injection

    Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer co…

    composer composer composer/composer composer Debian Ubuntu Alpine Packagist

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-40261
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-40176
  • report
    https://access.redhat.com/security/cve/CVE-2025-67746
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8165.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2426283
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-67746
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-67746
  • article
    https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917
  • article
    https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71
  • article
    https://github.com/composer/composer/releases/tag/2.2.26
  • article
    https://github.com/composer/composer/releases/tag/2.9.3
  • article
    https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353g
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458828
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-40176
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-40176
  • article
    https://github.com/composer/composer/releases/tag/2.9.6
  • article
    https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458841
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-40261
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-40261
  • article
    https://github.com/composer/composer/security/advisories/GHSA-gqw4-4w2p-838q