Red Hat Security Advisory

RHSA-2026:86202

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-10-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images lemon-3.54.1-1.hum1@aarch64, lemon-3.54.1-1.hum1@s390x, lemon-3.54.1-1.hum1@x86_64 +25

Fixes 3 records

TI-2026-82983 CVE-2026-119373 · GHSA-mw7g-h5m4-mrxh

Heap buffer overflow in SQLite FTS5 rowid list merging

HIGH 72

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00162 Published 2026-10-30 Partial fix · 3.54.0 CWE-787

TI-2026-83034 CVE-2026-119591 · GHSA-24xm-6g3f-6mqq

Stack exhaustion in SQLite count(*) over large VALUES clause

MEDIUM 63

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00171 Published 2026-10-30 Partial fix · 3.54.0 CWE-674

TI-2026-82988 CVE-2026-119378 · GHSA-gf9q-68cx-3mq4

Use-after-free in SQLite R-Tree extension crashes applications

LOW 30

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00251 Published 2026-10-30 Partial fix · 3.54.0 CWE-416