Red Hat Security Advisory

RHSA-2026:17075

yggdrasil security update

Released 2026-05-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) yggdrasil-0.4.8-5.el10_1
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) yggdrasil-devel-0.4.8-5.el10_1

Fixes 2 records

TI-2026-24812 CVE-2026-32283 · GHSA-jrg3-gfjw-hm96

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

MEDIUM 40

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00632 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-770

TI-2026-24811 CVE-2026-32282 · GHSA-xj38-jxc5-rppx

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

LOW 30

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.

CVSS 3.1MEDIUM 6.4 Local High privileges No interaction EPSS 0.00297 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-59