Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 6

Vulnerabilities 12

• High 8.8
  CVE-2026-96957

  .NET Security Feature Bypass Vulnerability

  Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 10.0 runtime Microsoft Visual Studio 2026 version 18.10 Ubuntu Alpine
  Oct 13, 2026
• High 7.8
  CVE-2026-96225

  .NET Elevation of Privilege Vulnerability

  Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.8
  CVE-2026-96231

  .NET Elevation of Privilege Vulnerability

  Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-58280

  .NET Denial of Service Vulnerability

  Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-69651

  .NET Denial of Service Vulnerability

  Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-70159

  ASP.NET Core Denial of Service Vulnerability

  Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 Microsoft.AspNetCore.SignalR.Core Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-84008

  .NET Denial of Service Vulnerability

  Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-96233

  ASP.NET Core Denial of Service Vulnerability

  Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-96237

  .NET Remote Code Execution Vulnerability

  Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine
  Oct 13, 2026
• High 7.5
  CVE-2026-96959

  .NET Denial of Service Vulnerability

  Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• Medium 6.5
  CVE-2026-96238

  .NET Security Feature Bypass Vulnerability

  Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine
  Oct 13, 2026
• Medium 5.9
  CVE-2026-66822

  .NET Information Disclosure Vulnerability

  Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-70159
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-58280
• report
  https://access.redhat.com/security/cve/CVE-2026-96957
• report
  https://access.redhat.com/security/cve/CVE-2026-69651
• report
  https://access.redhat.com/security/cve/CVE-2026-66822
• report
  https://access.redhat.com/security/cve/CVE-2026-96237
• report
  https://access.redhat.com/security/cve/CVE-2026-96238
• report
  https://access.redhat.com/security/cve/CVE-2026-96233
• report
  https://access.redhat.com/security/cve/CVE-2026-96231
• report
  https://access.redhat.com/security/cve/CVE-2026-96225
• report
  https://access.redhat.com/security/cve/CVE-2026-96959
• report
  https://access.redhat.com/security/cve/CVE-2026-84008
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84491.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548778
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-58280
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-58280
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548781
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-66822
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-66822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548784
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-69651
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-69651
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548786
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-70159
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-70159
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2550849
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-84008
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-84008
• article
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548803
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-96225
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-96225
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548805
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-96231
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-96231
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548806
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-96233