Red Hat Security Advisory

RHSA-2026:63514

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-09-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images cargo-1.98.0-1.hum1@aarch64, cargo-1.98.0-1.hum1@x86_64, clippy-1.98.0-1.hum1@aarch64 +36

Fixes 3 records

TI-2026-16162 CVE-2026-19931 · GHSA-rhw6-3rrg-mwjq

Negotiate ambient user conn reuse

HIGH 82

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00747 Published 2026-09-06 Partial fix · 8.14.2, 8.16.1 +2 CWE-488

TI-2026-15472 CVE-2026-18924 · GHSA-xcm8-9xjx-f5jq

HTTP/2 server push UAF

HIGH 78

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00584 Published 2026-09-06 Partial fix · 8.14.2, 8.16.1 +2 CWE-416

TI-2026-11527 CVE-2026-13608 · GHSA-3968-82gf-vhpr

OpenLDAP SASL authentication bypass

HIGH 68

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.005 Published 2026-09-06 Partial fix · 8.14.2, 8.16.1 +2 CWE-923