Red Hat Security AdvisoryRHSA-2026:9228
Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-04-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images python-unversioned-command-3.14.4-2.hum1@noarch@public-hummingbird-aarch64-rpms, python-unversioned-command-3.14.4-2.hum1@noarch@public-hummingbird-x86_64-rpms, python3-3.14.4-2.hum1@aarch64 +28
Fixes 5 records
Priority MEDIUM 42
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00579 · Published 2026-04-13 · Partial fix · 3.10.21, 3.11.16 +4 CWE-416
Priority LOW 33
Mitgation of CVE-2026-4519 was incomplete.
CVSS 4.0HIGH 7.0· Local · No auth · User interaction · EPSS 0.0029 · Published 2026-04-13 · Partial fix · 3.10.21, 3.11.16 +4 CWE-77
Priority LOW 29
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines.
CVSS 4.0MEDIUM 5.9· Network · High privileges · No interaction · EPSS 0.00431 · Published 2026-01-20 · Partial fix · 3.13.15, 3.14.7 +1 CWE-77
Priority LOW 26
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
CVSS 4.0MEDIUM 5.7· Network · High privileges · User interaction · EPSS 0.00535 · Published 2026-04-10 · Partial fix · 3.10.21, 3.11.16 +4 CWE-93
Priority LOW 25
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged pr…
CVSS 4.0MEDIUM 5.3· Local · High privileges · User interaction · EPSS 0.00132 · Published 2026-04-14 · Partial fix · 3.14.5, 3.15.0b1 CWE-121
THREATIST.IORead the docs