Red Hat Security AdvisoryRHSA-2026:5447
RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release
Released 2026-03-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
Fixes 4 records
Priority HIGH 69
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.
CVSS 3.1HIGH 8.2· Network · No auth · User interaction · EPSS 0.00608 · Published 2026-01-28 · Partial fix · 7.5.7 CWE-22
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02292 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
Priority LOW 33
node-tar is a full-featured Tar for Node.js.
CVSS 3.1HIGH 7.1· Local · No auth · User interaction · EPSS 0.00328 · Published 2026-02-20 · Partial fix · 7.5.8 CWE-22
Priority LOW 30
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00738 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
