Red Hat Security Advisory

RHSA-2026:27998

Cost Management Metrics Operator Update

Released 2026-06-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Cost Management 4 registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator

Fixes 7 records

TI-2026-03505 CVE-2026-4046 · GHSA-g7c4-wv7q-gcc6

iconv crash due to assertion failure with untrusted input

HIGH 72

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an applicat…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00389 Published 2026-03-30 Partial fix CWE-617

TI-2026-24346 CVE-2026-31790 · GHSA-vgxx-5xj5-q97x

Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

MEDIUM 41

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01049 Published 2026-04-07 Partial fix · 3.6.2, 3.5.6 +3 CWE-754

TI-2026-01754 CVE-2026-2100 · GHSA-hq85-3f6c-jx84

P11-kit: null dereference via c_derivekey with specific null parameters

MEDIUM 41

A flaw was found in p11-kit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01311 Published 2026-03-26 Partial fix · 0.26.2, 0.26.2-1.el10 +21 CWE-824

TI-2026-22665 CVE-2026-28390 · GHSA-fgpp-q3px-3xhc

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

MEDIUM 40

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00836 Published 2026-04-07 Partial fix · 3.6.2, 3.5.6 +5 CWE-476

TI-2026-03848 CVE-2026-4437 · GHSA-m5wq-r4r4-4qrh

gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response

LOW 39

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS s…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00345 Published 2026-03-20 Partial fix CWE-125

TI-2026-04252 CVE-2026-4878

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

LOW 32

A flaw was found in libcap.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00209 Published 2026-04-09 Partial fix · 2.69-7.el10_1.1, 2.69-7.el10_2.1 +51 CWE-367

TI-2026-03849 CVE-2026-4438 · GHSA-935r-rfch-9mr7

gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames

LOW 24

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned t…

CVSS 3.1MEDIUM 5.4 Adjacent network No auth No interaction EPSS 0.00314 Published 2026-03-20 Partial fix CWE-20