Red Hat Security Advisory

RHSA-2026:83603

RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release

Released 2026-10-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/tuffer-rhel9, registry.redhat.io/rhtas/tuftool-rhel9

Fixes 2 records

TI-2026-63063 CVE-2026-93599 · GHSA-g42g-9vm4-7gfj

rustls-webpki before 0.103.13 Panic via empty BIT STRING

HIGH 77

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00346 Published 2026-09-18 Partial fix · 0.103.13, 0.104.0-alpha.7 CWE-191

TI-2026-14928 CVE-2026-18140 · GHSA-8ffr-xgwf-xj56

Uncontrolled recursion in aws-smithy-json

MEDIUM 45

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthentica…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00784 Published 2026-07-30 Partial fix · 0.62.7 CWE-674