RLSA-2026:99595 — Moderate: rpm security update

Summary

The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

Security Fix(es):

* rpm: Command injection in rpmuncompress via unescaped filenames passed to popen() (CVE-2026-84838)

* rpm: Command Injection in `rpmbuild -t*` (`getTarSpec`) via Unescaped Tarball Path (CVE-2026-84837)

* rpm: Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames (CVE-2026-84233)

* rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 126

Release	Package	Fixed in
Rocky Linux · 10	python3-rpm	0:4.19.1.1-29.el10_3
Rocky Linux · 10	python3-rpm	0:4.19.1.1-29.el10_3
Rocky Linux · 10	python3-rpm	0:4.19.1.1-29.el10_3
Rocky Linux · 10	python3-rpm	0:4.19.1.1-29.el10_3
Rocky Linux · 10	python3-rpm-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	python3-rpm-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	python3-rpm-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	python3-rpm-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-apidocs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-libs-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-libs-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-libs-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-build-libs-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-cron	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-debugsource	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-debugsource	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-debugsource	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-debugsource	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-devel	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-devel	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-devel	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-devel	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-devel-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-devel-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-devel-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-devel-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-libs-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-libs-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-libs-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-libs-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-audit	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-audit	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-audit	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-audit	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-audit-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-audit-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-audit-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-audit-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-dbus-announce	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-dbus-announce	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-dbus-announce	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-dbus-announce	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-dbus-announce-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-dbus-announce-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-dbus-announce-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-dbus-announce-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-fapolicyd	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-fapolicyd	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-fapolicyd	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-fapolicyd	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-fapolicyd-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-fapolicyd-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-fapolicyd-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-fapolicyd-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-ima	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-ima	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-ima	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-ima	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-ima-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-ima-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-ima-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-ima-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-selinux	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-selinux	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-selinux	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-selinux	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-selinux-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-selinux-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-selinux-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-selinux-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-syslog	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-syslog	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-syslog	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-syslog	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-syslog-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-syslog-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-syslog-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-syslog-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-systemd-inhibit	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-systemd-inhibit	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-systemd-inhibit	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-systemd-inhibit	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-systemd-inhibit-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-systemd-inhibit-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-systemd-inhibit-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-plugin-systemd-inhibit-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-libs	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-libs-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-libs-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-libs-debuginfo	0:4.19.1.1-29.el10_3
Rocky Linux · 10	rpm-sign-libs-debuginfo	0:4.19.1.1-29.el10_3

Vulnerabilities 4

High 7.8

CVE-2026-84837

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous int…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu

Sep 2, 2026
High 7.8

CVE-2026-84838

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properl…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux

Sep 2, 2026
High 7.0

CVE-2026-78367

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro ex…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu

Aug 24, 2026
High 7.0

CVE-2026-84233

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This all…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux

Sep 1, 2026

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2478408
report
https://bugzilla.redhat.com/show_bug.cgi?id=2462222
report
https://bugzilla.redhat.com/show_bug.cgi?id=2521857
report
https://bugzilla.redhat.com/show_bug.cgi?id=2478409
advisory
https://access.redhat.com/errata/RHSA-2026:99595

Moderate: rpm security update

Summary

Fixed packages 126

Vulnerabilities 4

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

References