Red Hat Security Advisory

RHSA-2026:42230

Red Hat Hardened Images RPMs Security Update

Released 2026-07-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images helm4-4.2.3-0.1.2.hum1@aarch64, helm4-4.2.3-0.1.2.hum1@src, helm4-4.2.3-0.1.2.hum1@x86_64

Fixes 3 records

TI-2026-36926 CVE-2026-50162 · GHSA-8xwf-rjm4-xvhv

oras-go: file store write outside workingDir via symlink traversal

HIGH 70

oras-go is a Go library for managing OCI artifacts.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00437 Published 2026-07-17 Partial fix · 2.6.1 CWE-73

TI-2026-45154 CVE-2026-63308 · GHSA-5gjx-96wq-c8r2

Helm Files.Lines Denial of Service via Empty Chart Files

MEDIUM 57

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00486 Published 2026-07-17 Partial fix CWE-129

TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r

Infinite loop on invalid input in golang.org/x/text

LOW 39

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00475 Published 2026-07-21 Partial fix · 0.39.0 CWE-835