Red Hat Security Advisory

RHSA-2026:92620

satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

Released 2026-10-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9

Fixes 4 records

TI-2026-63063 CVE-2026-93599 · GHSA-g42g-9vm4-7gfj

rustls-webpki before 0.103.13 Panic via empty BIT STRING

HIGH 77

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00346 Published 2026-09-18 Partial fix · 0.103.13, 0.104.0-alpha.7 CWE-191

TI-2026-59936 CVE-2026-87819 · GHSA-g5vv-9gxw-82hx

GitPython before 3.1.60 Denial of Service via ReDoS

MEDIUM 44

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00521 Published 2026-09-09 Partial fix · 3.1.60 CWE-1333

TI-2026-58283 CVE-2026-84782 · GHSA-6w84-hw79-7wgf

DTLS Retransmits Handshake Messages From a Stale Buffer Offset

MEDIUM 43

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00831 Published 2026-09-29 Partial fix · 4.0.3, 3.6.5 +5 CWE-125

TI-2026-74547 CVE-2026-110857

Remote code execution in GitPython via ls_remote ext:: URLs

LOW 36

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00417 Published 2026-10-14 Partial fix · 3.2.0 CWE-1287