Red Hat Security Advisory

RHSA-2026:95365

Red Hat Cost Management On-Premise container image update

Released 2026-11-04 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10

Fixes 14 records

TI-2026-53553 CVE-2026-76642

util-linux libmount Privilege Escalation via Failed Mount Helper

HIGH 72

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00216 Published 2026-09-03 Fixed in 2.41.6, 2.42.3 CWE-390

TI-2026-54523 CVE-2026-78410

Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

HIGH 69

A flaw was found in util-linux.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00198 Published 2026-09-02 Fixed in 2.40.2-18.el10_2.20, 1793825318 +1 CWE-367

TI-2026-54521 CVE-2026-78408

Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

HIGH 68

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve().

CVSS 3.1HIGH 7.9 Local Low privileges User interaction EPSS 0.00237 Published 2026-09-02 Fixed in 2.40.2-18.el10_2.20, 1793825318 +1 CWE-775

TI-2026-73994 CVE-2026-53612

Race condition in util-linux mount hook allows privilege escalation

HIGH 66

util-linux is a random collection of Linux utilities.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00152 Published 2026-10-14 Fixed in 2.41.5, 2.42.2 CWE-367

TI-2026-21863 CVE-2026-27456

util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup

MEDIUM 55

util-linux is a random collection of Linux utilities.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00157 Published 2026-04-03 Partial fix · 2.41.4 CWE-269

TI-2026-69154 CVE-2026-77214 · GHSA-8xfx-9m5m-pgcp

Heap buffer over-read in libexpat XML_ParseBuffer

MEDIUM 42

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.0032 Published 2026-10-07 Partial fix CWE-125

TI-2026-64264 CVE-2026-97689 · GHSA-vxq7-64xx-v4gw

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

LOW 38

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00335 Published 2026-09-29 Partial fix · 2.8.0 CWE-770

TI-2026-65452 CVE-2026-102633 · GHSA-533f-rf84-jgcc

libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc

LOW 36

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00368 Published 2026-09-29 Partial fix CWE-190

TI-2026-64262 CVE-2026-97687 · GHSA-8988-9cw3-xx77

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

LOW 35

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00206 Published 2026-09-29 Partial fix · 2.8.0 CWE-295

TI-2026-74163 CVE-2026-53615

Integer overflow in util-linux libblkid DOS extended partition parsing

LOW 34

util-linux is a random collection of Linux utilities.

CVSS 3.1HIGH 8.0 Local No auth No interaction EPSS 0.00178 Published 2026-10-14 Partial fix · 2.41.4 CWE-190

TI-2026-79000 CVE-2026-114406 · GHSA-jrx5-4fv3-4mcq

Red Hat system CA store trusts weak eMudhra intermediate certificates

LOW 32

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak pr…

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.0031 Published 2026-10-21 Partial fix · 2026.2.92_v9.0.319-100.3.el10_2, 2026.2.92_v9.0.319-100.3.el10_0 +138 CWE-295

TI-2026-73996 CVE-2026-53614