Read the docs
Red Hat Security Advisory

RHSA-2026:26319

Red Hat Update Infrastructure 5.2 security update

Released 2026-06-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 34 records

TI-2026-03505 CVE-2026-4046 · GHSA-g7c4-wv7q-gcc6

iconv crash due to assertion failure with untrusted input

Priority HIGH 72

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an applicat…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00389 Published 2026-03-30 Partial fix CWE-617
TI-2026-26211 CVE-2026-33845 · GHSA-cmj5-x3xf-69wq

Gnutls: gnutls: denial of service via dtls zero-length fragment

Priority MEDIUM 49

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02073 Published 2026-04-30 Partial fix · 3.8.13, 3.8.10-4.el10_2 +45 CWE-191
TI-2026-33226 CVE-2026-45447 · GHSA-f684-cpcq-j565

Heap Use-After-Free in the PKCS7_verify() Function

Priority MEDIUM 47

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04002 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +5 CWE-416
TI-2026-26479 CVE-2026-34182 · GHSA-f9v2-4w9p-2cwc

CMS AuthEnvelopedData Processing May Accept Forged Messages

Priority MEDIUM 47

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01057 Published 2026-06-09 Fixed in 4.0.1, 3.6.3 +3 CWE-354
TI-2026-30987 CVE-2026-42764 · GHSA-5pg7-f6xv-j6m4

NULL Pointer Dereference in QUIC Server Initial Packet Handling

Priority MEDIUM 41

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01165 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +1 CWE-476
TI-2026-26480 CVE-2026-34183 · GHSA-f5vx-f6jp-89j6

Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

Priority MEDIUM 41

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01049 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +2 CWE-1325
TI-2026-33224 CVE-2026-45445 · GHSA-v446-xwfm-x7mr

AES-OCB IV Ignored on EVP_Cipher() Path

Priority MEDIUM 40

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00704 Published 2026-06-09 Fixed in 4.0.1, 3.6.3 +3 CWE-325
TI-2026-07973 CVE-2026-9076 · GHSA-q98x-73c3-57gj

Out-of-Bounds Read in CMS Password-Based Decryption

Priority MEDIUM 40

Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key().

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00707 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +5 CWE-125
TI-2026-06486 CVE-2026-7383 · GHSA-w853-v86g-gv7j

Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion

Priority LOW 39

Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00804 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +5 CWE-787
TI-2026-03848 CVE-2026-4437 · GHSA-m5wq-r4r4-4qrh

gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response

Priority LOW 39

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS s…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00345 Published 2026-03-20 Partial fix CWE-125
TI-2026-26477 CVE-2026-34180 · GHSA-3c8f-qq7h-7qv6

Heap Buffer Over-read in ASN.1 Content Parsing

Priority LOW 35

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01025 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +5 CWE-125
TI-2026-30990 CVE-2026-42767 · GHSA-gxhg-7jx8-m22j

NULL Pointer Dereference in CRMF EncryptedValue Decryption

Priority LOW 33

Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00557 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +3 CWE-476
TI-2026-26478 CVE-2026-34181 · GHSA-4jgc-cj59-f9mm

PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys

Priority LOW 33

Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00376 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +2 CWE-354
TI-2026-30989 CVE-2026-42766 · GHSA-58mv-qqmv-gqgv

Possible NULL Dereference in Password-Based CMS Decryption

Priority LOW 29

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.0106 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +5 CWE-476
TI-2026-30992 CVE-2026-42769 · GHSA-rpj2-p5pj-r33v

Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate

Priority LOW 25

Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could…

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00544 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +2 CWE-295
TI-2026-03849 CVE-2026-4438 · GHSA-935r-rfch-9mr7

gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames

Priority LOW 24

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned t…

CVSS 3.1MEDIUM 5.4 Adjacent network No auth No interaction EPSS 0.00314 Published 2026-03-20 Partial fix CWE-20
TI-2026-33225 CVE-2026-45446 · GHSA-7phf-qpm5-q6p3

Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

Priority LOW 22

Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00439 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +3 CWE-325
TI-2026-30991 CVE-2026-42768 · GHSA-5m8f-m8jv-3rp3

Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()

Priority LOW 19

Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00801 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +2 CWE-514
TI-2026-30993 CVE-2026-42770 · GHSA-3cxm-476w-ghm2

FFC-DH Peer Validation Uses Attacker-Supplied q

Priority LOW 18

Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00503 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +3 CWE-325