Red Hat Security Advisory

RHSA-2026:68290

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-09-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images opentelemetry-collector-contrib-0.161.0-0.1.hum1@aarch64, opentelemetry-collector-contrib-0.161.0-0.1.hum1@src, opentelemetry-collector-contrib-0.161.0-0.1.hum1@x86_64

Fixes 10 records

TI-2026-62978 CVE-2026-93450 · GHSA-j354-7hcm-wg69

go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

HIGH 77

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01318 Published 2026-09-17 Partial fix · 0.27.1 CWE-674

TI-2026-56486 CVE-2026-81872 · GHSA-hjf4-fphr-2h65

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

MEDIUM 61

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00383 Published 2026-09-16 Partial fix · 0.21.0 CWE-400

TI-2026-54002 CVE-2026-77412 · GHSA-4v58-74mf-rjx3

RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client

MEDIUM 45

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00524 Published 2026-09-16 Partial fix · 1.13.0 CWE-681

TI-2026-53999 CVE-2026-77409

RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking

MEDIUM 42

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00524 Published 2026-09-16 Partial fix · 1.13.0 CWE-770

TI-2026-45095 CVE-2026-63209 · GHSA-259r-337f-4rfw

Integer Overflow or Wraparound and Out-of-bounds Write in compress

MEDIUM 40

compress provides various compression algorithms.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00572 Published 2026-09-29 Partial fix · 1.18.7 CWE-190

TI-2026-54000 CVE-2026-77410 · GHSA-r9c8-gcjp-xfwh

RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation

LOW 39

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00524 Published 2026-09-16 Partial fix · 1.13.0 CWE-789

TI-2026-53993 CVE-2026-77403 · GHSA-xwwf-m8fg-p9q2

RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation

LOW 39

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00524 Published 2026-09-16 Partial fix · 1.13.0 CWE-770

TI-2026-53994 CVE-2026-77404 · GHSA-465g-fh3v-9jw4

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

LOW 38

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.

CVSS 4.0HIGH 8.7 Local Low privileges No interaction EPSS 0.00104 Published 2026-09-16 Partial fix · 1.13.0 CWE-116

TI-2026-53996 CVE-2026-77406 · GHSA-rm6m-hrcw-jw33

RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration

LOW 36

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00524 Published 2026-09-16 Partial fix · 1.13.0 CWE-195

TI-2026-53997 CVE-2026-77407 · GHSA-27gv-rfvv-22mv

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

LOW 30

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.

CVSS 4.0HIGH 7.0 Local Low privileges No interaction EPSS 0.00131 Published 2026-09-16 Partial fix · 1.13.0 CWE-316