Red Hat Security AdvisoryRHSA-2026:38091
Red Hat Hardened Images RPMs Security Update
Released 2026-07-10 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images python3.14-3.14.6-1.4.hum1@aarch64, python3.14-3.14.6-1.4.hum1@src, python3.14-3.14.6-1.4.hum1@x86_64 +26
Fixes 3 records
Priority HIGH 67
### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00399 · Published 2026-05-16 · Partial fix · 6.15.2 CWE-476
Priority MEDIUM 41
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.
CVSS 4.0HIGH 7.8· Network · No auth · No interaction · EPSS 0.0075 · Published 2026-06-23 · Partial fix · 3.10.21, 3.11.16 +4 CWE-22
Priority MEDIUM 41
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00971 · Published 2025-06-03 · Partial fix · 3.9.23, 3.10.18 +4 CWE-22
