RLSA-2026:99593 — Moderate: rpm security update

Summary

The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

Security Fix(es):

* rpm: Command Injection in `rpmbuild -t*` (`getTarSpec`) via Unescaped Tarball Path (CVE-2026-84837)

* rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 128

Release	Package	Fixed in
Rocky Linux · 9	python3-rpm	0:4.16.1.3-43.el9_9
Rocky Linux · 9	python3-rpm	0:4.16.1.3-43.el9_9
Rocky Linux · 9	python3-rpm	0:4.16.1.3-43.el9_9
Rocky Linux · 9	python3-rpm	0:4.16.1.3-43.el9_9
Rocky Linux · 9	python3-rpm-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	python3-rpm-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	python3-rpm-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	python3-rpm-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-apidocs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-build-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-cron	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-debugsource	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-debugsource	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-debugsource	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-debugsource	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-debugsource	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-devel	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-devel	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-devel	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-devel	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-devel	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-devel-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-devel-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-devel-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-devel-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-devel-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-audit	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-audit	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-audit	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-audit	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-audit-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-audit-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-audit-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-audit-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-fapolicyd	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-fapolicyd	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-fapolicyd	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-fapolicyd	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-fapolicyd-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-fapolicyd-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-fapolicyd-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-fapolicyd-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-ima	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-ima	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-ima	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-ima	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-ima-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-ima-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-ima-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-ima-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-selinux	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-selinux	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-selinux	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-selinux	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-selinux-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-selinux-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-selinux-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-selinux-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-syslog	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-syslog	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-syslog	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-syslog	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-syslog-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-syslog-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-syslog-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-syslog-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-systemd-inhibit	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-systemd-inhibit	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-systemd-inhibit	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-systemd-inhibit	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-systemd-inhibit-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-systemd-inhibit-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-systemd-inhibit-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-plugin-systemd-inhibit-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-libs	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-libs-debuginfo	0:4.16.1.3-43.el9_9
Rocky Linux · 9	rpm-sign-libs-debuginfo	0:4.16.1.3-43.el9_9

Vulnerabilities 2

High 7.8

CVE-2026-84837

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous int…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu

Sep 2, 2026
High 7.0

CVE-2026-78367

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro ex…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu

Aug 24, 2026

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2478408
report
https://bugzilla.redhat.com/show_bug.cgi?id=2521857
advisory
https://access.redhat.com/errata/RHSA-2026:99593

Moderate: rpm security update

Summary

Fixed packages 128

Vulnerabilities 2

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

References