Red Hat Security Advisory

RHSA-2026:17596

OpenShift Container Platform 4.17.54 bug fix and security update

Released 2026-05-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202605112123-0, rhcos-ppc64le-417.94.202605112123-0, rhcos-s390x-417.94.202605112123-0 +1

Fixes 11 records

TI-2026-20746 CVE-2026-25646

LIBPNG has a heap buffer overflow in png_set_quantize

HIGH 69

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.0112 Published 2026-02-10 Partial fix · 1.6.55 CWE-122

TI-2026-04471 CVE-2026-5121 · GHSA-2vwv-vqpv-v8vc

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

MEDIUM 51

A flaw was found in libarchive.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01092 Published 2026-03-30 Partial fix · 3.1.2-14.el7_9.2, 3.3.3-7.el8_10 +51 CWE-190

TI-2026-03838 CVE-2026-4424 · GHSA-c75f-55f6-f63q

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

MEDIUM 41

A flaw was found in libarchive.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01287 Published 2026-03-19 Partial fix · 3.7.7-8.el10_1, 3.7.7-5.el10_0 +54 CWE-125

TI-2026-21585 CVE-2026-27135

nghttp2 Denial of service: Assertion failure due to the missing state validation

MEDIUM 40

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00823 Published 2026-03-18 Fixed in 1.68.1 CWE-617

TI-2026-03561 CVE-2026-4111 · GHSA-xrqh-48jh-pjv2

Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

MEDIUM 40

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00721 Published 2026-03-13 Partial fix · 3.7.7-5.el10_1, 3.7.7-5.el10_0 +33 CWE-835

TI-2026-22691 CVE-2026-28417

Vim has OS Command Injection in netrw

LOW 39

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01353 Published 2026-02-27 Fixed in 9.2.0073 CWE-86

TI-2026-25809 CVE-2026-33412

Vim affected by Command injection via newline in glob()

LOW 36

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00867 Published 2026-03-24 Fixed in 9.2.0202 CWE-78

TI-2026-22695 CVE-2026-28421

Vim has a heap-buffer-overflow and a segmentation fault

LOW 35

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00206 Published 2026-02-27 Fixed in 9.2.0077 CWE-122

TI-2025-38095 CVE-2025-61662 · GHSA-g7mr-vm94-3rv7

Grub2: missing unregister call for gettext command may lead to use-after-free

LOW 33

A Use-After-Free vulnerability has been discovered in GRUB's gettext module.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00219 Published 2025-11-18 Fixed in 1:2.12-29.el10_1.2, 1:2.12-15.el10_0.2 +19 CWE-416

TI-2026-20817 CVE-2026-25749

Heap Overflow in Vim

LOW 29

Vim is an open source, command line text editor.

CVSS 3.1MEDIUM 6.6 Local Low privileges User interaction EPSS 0.00262 Published 2026-02-06 Partial fix · 9.1.2132 CWE-122

TI-2026-03014 CVE-2026-3497 · GHSA-wcpp-3x59-h8vp

Use of uninitialized resource in Ubuntu openssh

LOW 24

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.02375 Published 2026-03-12 Partial fix · 1:10.0p1-5ubuntu5.1, 1:9.6p1-3ubuntu13.15 +1 CWE-908