Read the docs
TI-2026-17326 Aliases CVE-2026-21441GHSA-38jv-5279-wg99

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

Priority MEDIUM 50CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 90 fixed, 27 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02922 87th percentileScored 2026-11-07
Fix Partial urllib3 (urllib3): 2.6.3urllib3 (PyPI): 2.6.3Red Hat: 114 advisoriesRed Hat: 90 fixed, 27 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
python-pillowurllib31.22 to before 2.6.32.6.3Patch availableCNA
—urllib3 (PyPI)1.22 to before 2.6.32.6.3Patch availableGHSA-38jv-5279-wg99
  • urllib3 Vendorpython-pillow Affected 1.22 to before 2.6.3 Fixed in 2.6.3 Patch available CNA
  • urllib3 (PyPI) Vendor— Affected 1.22 to before 2.6.3 Fixed in 2.6.3 Patch available GHSA-38jv-5279-wg99

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*1.22 to before 2.6.3Vulnerablepython-pillow
  • cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* Versions 1.22 to before 2.6.3 Vulnerable ·python-pillow

Remediation

  • Fix · CNA urllib3 (urllib3) Fixed in 2.6.3
  • Fix · GHSA-38jv-5279-wg99 urllib3 (PyPI) Fixed in 2.6.3 Advisory →

Red Hat 114 advisories

  • RHSA-2026:92650 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.26 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:86618 Released 2026-10-21 · Red Hat rating Critical
    New container image: rhceph-9.2
    • Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
  • RHSA-2026:61628 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
Show 111 more Red Hat advisories
  • RHSA-2026:51357 Released 2026-08-06 · Red Hat rating Important
    satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
  • RHSA-2026:44696 Released 2026-07-23 · Red Hat rating Important
    satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.17 registry.redhat.io/satellite/iop-advisor-engine-rhel9
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:33154 Released 2026-06-29 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2026:28441 Released 2026-06-23 · Red Hat rating Important
    Red Hat Openshift Mirror Registry v2.0.11
    • mirror registry for Red Hat OpenShift 2.0 registry.redhat.io/openshift/mirror-registry-rhel8
  • RHSA-2026:28043 Released 2026-06-22 · Red Hat rating Important
    Red Hat OpenStack Platform 17.1 (python-urllib3) security update
    • Red Hat OpenStack Platform 17.1 python-urllib3-1.26.5-3.el8ost.3, python3-urllib3-1.26.5-3.el8ost.3
  • RHSA-2026:25127 Released 2026-06-10 · Red Hat rating Important
    Submariner v0.21 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9, registry.redhat.io/rhacm2/nettest-rhel9 +5
  • RHSA-2026:19712 Released 2026-05-20 · Red Hat rating Critical
    RHOAI 3.3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
  • RHSA-2026:17463 Released 2026-05-14 · Red Hat rating Important
    zero trust workload identity manager for Red Hat OpenShift 1.0.1
    • Zero Trust Workload Identity Manager 1.0 registry.redhat.io/zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9
  • RHSA-2026:17462 Released 2026-05-14 · Red Hat rating Important
    zero trust workload identity manager for Red Hat OpenShift 1.0.1
    • Zero Trust Workload Identity Manager 1.0 registry.redhat.io/zero-trust-workload-identity-manager/spiffe-spire-server-rhel9
  • RHSA-2026:17461 Released 2026-05-14 · Red Hat rating Important
    zero trust workload identity manager for Red Hat OpenShift 1.0.1
    • Zero Trust Workload Identity Manager 1.0 registry.redhat.io/zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9
  • RHSA-2026:17460 Released 2026-05-14 · Red Hat rating Important
    zero trust workload identity manager for Red Hat OpenShift 1.0.1
    • Zero Trust Workload Identity Manager 1.0 registry.redhat.io/zero-trust-workload-identity-manager/spiffe-spire-controller-manager-rhel9
  • RHSA-2026:17457 Released 2026-05-14 · Red Hat rating Important
    zero trust workload identity manager for Red Hat OpenShift 1.0.1
    • Zero Trust Workload Identity Manager 1.0 registry.redhat.io/zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9
  • RHSA-2026:17456 Released 2026-05-14 · Red Hat rating Important
    zero trust workload identity manager for Red Hat OpenShift 1.0.1
    • Zero Trust Workload Identity Manager 1.0 registry.redhat.io/zero-trust-workload-identity-manager/spiffe-csi-driver-rhel9
  • RHSA-2026:14877 Released 2026-05-07 · Red Hat rating Important
    General availability of the satellite/iop-puptoo-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-puptoo-rhel9
  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:8501 Released 2026-04-16 · Red Hat rating Critical
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:8500 Released 2026-04-16 · Red Hat rating Critical
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:8151 Released 2026-04-14 · Red Hat rating Important
    Submariner v0.22 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9, registry.redhat.io/rhacm2/nettest-rhel9 +5
  • RHSA-2026:6292 Released 2026-03-31 · Red Hat rating Important
    General availability of the satellite/iop-insights-engine-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-insights-engine-rhel9
  • RHSA-2026:6287 Released 2026-03-31 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:5459 Released 2026-03-23 · Red Hat rating Important
    RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/tuffer-rhel9, registry.redhat.io/rhtas/tuftool-rhel9
  • RHSA-2026:4467 Released 2026-03-12 · Red Hat rating Important
    RHACS 4.9.4 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2026:4466 Released 2026-03-12 · Red Hat rating Important
    RHACS 4.8.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2026:4271 Released 2026-03-11 · Red Hat rating Important
    RHTAS 1.3.2 - Tech Preview Release of Model Transparency
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/model-transparency-rhel9
  • RHSA-2026:4215 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.14.6
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:4185 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.13.11
    • Red Hat Quay 3.13 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:3960 Released 2026-03-06 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9 +9
  • RHSA-2026:3884 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.19.2 security update
    • Red Hat OpenShift GitOps 1.19 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8 +5
  • RHSA-2026:3874 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.18.4 security update
    • Red Hat OpenShift GitOps 1.18 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8 +6
  • RHSA-2026:3869 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.17.5 security update
    • Red Hat OpenShift GitOps 1.17 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8 +6
  • RHSA-2026:3782 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 2.25.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +27
  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:3462 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:3461 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:3444 Released 2026-02-26 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:3406 Released 2026-02-26 · Red Hat rating Important
    New container image: rhceph-9.0
    • Red Hat Ceph Storage 9 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
  • RHSA-2026:3296 Released 2026-02-25 · Red Hat rating Important
    RHTAS - Tech Preview Release Of the Policy Controller Operator
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/policy-controller-rhel9-operator
  • RHSA-2026:2926 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-search-ui-rhel9 +6
  • RHSA-2026:2925 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/segment-reporting-rhel9
  • RHSA-2026:2924 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/client-server-rhel9
  • RHSA-2026:2919 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/tuffer-rhel9, registry.redhat.io/rhtas/tuftool-rhel9
  • RHSA-2026:2911 Released 2026-02-18 · Red Hat rating Important
    python-s3transfer security update
    • Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS) python-s3transfer-0.1.13-1.el7_9.6
    • Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS) python-s3transfer-0.1.13-1.el7_9.6
  • RHSA-2026:2900 Released 2026-02-18 · Red Hat rating Important
    Network Observability 1.11.0 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2
  • RHSA-2026:2765 Released 2026-02-16 · Red Hat rating Important
    Satellite 6.16.6.1 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 python-urllib3-2.6.3-0.1.el8pc, python3.11-urllib3-2.6.3-0.1.el8pc
    • Red Hat Satellite 6.16 for RHEL 9 python-urllib3-2.6.3-0.1.el9pc, python3.11-urllib3-2.6.3-0.1.el9pc
  • RHSA-2026:2764 Released 2026-02-16 · Red Hat rating Important
    Satellite 6.17.6.3 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 python-urllib3-2.6.3-0.1.el9pc, python3.11-urllib3-2.6.3-0.1.el9pc
  • RHSA-2026:2762 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.10.18
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2760 Released 2026-02-16 · Red Hat rating Important
    Satellite 6.18.3 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 python3.12-aiohttp-3.13.3-1.el9pc, python3.12-urllib3-2.6.3-1.el9pc
  • RHSA-2026:2728 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) python-urllib3-1.24.2-4.el8_2.1, python3-urllib3-1.24.2-4.el8_2.1
  • RHSA-2026:2718 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) python-urllib3-1.24.2-5.el8_8.3, python3-urllib3-1.24.2-5.el8_8.3
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) python-urllib3-1.24.2-5.el8_8.3, python3-urllib3-1.24.2-5.el8_8.3
  • RHSA-2026:2717 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-urllib3-1.24.2-5.el8_6.4, python3-urllib3-1.24.2-5.el8_6.4
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) python-urllib3-1.24.2-5.el8_6.4, python3-urllib3-1.24.2-5.el8_6.4
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) python-urllib3-1.24.2-5.el8_6.4, python3-urllib3-1.24.2-5.el8_6.4
  • RHSA-2026:2723 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) python-urllib3-1.24.2-5.el8_4.1, python3-urllib3-1.24.2-5.el8_4.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) python-urllib3-1.24.2-5.el8_4.1, python3-urllib3-1.24.2-5.el8_4.1
  • RHSA-2026:2695 Released 2026-02-12 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 +13
  • RHSA-2026:2681 Released 2026-02-12 · Red Hat rating Important
    Red Hat Quay 3.16.2
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:2563 Released 2026-02-11 · Red Hat rating Important
    Red Hat Update Infrastructure 5 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:2500 Released 2026-02-11 · Red Hat rating Important
    Red Hat multicluster global hub 1.4.4 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
  • RHSA-2026:2456 Released 2026-02-10 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.26.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:2256 Released 2026-02-09 · Red Hat rating Important
    Red Hat multicluster global hub 1.5.3 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
  • RHSA-2026:2144 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +7
  • RHSA-2026:2139 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/segment-reporting-rhel9
  • RHSA-2026:2137 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/client-server-rhel9
  • RHSA-2026:2126 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/tuffer-rhel9, registry.redhat.io/rhtas/tuftool-rhel9
  • RHSA-2026:2106 Released 2026-02-05 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:1957 Released 2026-02-04 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.12-urllib3-1.26.18-2.el9_4.2
  • RHSA-2026:1942 Released 2026-02-04 · Red Hat rating Important
    Red Hat Quay 3.15.3
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1805 Released 2026-02-03 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) resource-agents-4.1.1-90.el8_4.22, resource-agents-aliyun-4.1.1-90.el8_4.22, resource-agents-gcp-4.1.1-90.el8_4.22
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) resource-agents-4.1.1-90.el8_4.22, resource-agents-aliyun-4.1.1-90.el8_4.22, resource-agents-gcp-4.1.1-90.el8_4.22
  • RHSA-2026:1803 Released 2026-02-03 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents-4.2.1-65.el8_4.25, fence-agents-all-4.2.1-65.el8_4.25, fence-agents-amt-ws-4.2.1-65.el8_4.25 +39
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) fence-agents-4.2.1-65.el8_4.25, fence-agents-all-4.2.1-65.el8_4.25, fence-agents-amt-ws-4.2.1-65.el8_4.25 +36
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.25, fence-agents-aws-4.2.1-65.el8_4.25, fence-agents-azure-arm-4.2.1-65.el8_4.25 +1
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.25, fence-agents-aws-4.2.1-65.el8_4.25, fence-agents-azure-arm-4.2.1-65.el8_4.25 +1
  • RHSA-2026:1792 Released 2026-02-03 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) fence-agents-4.2.1-89.el8_6.20, fence-agents-all-4.2.1-89.el8_6.20, fence-agents-amt-ws-4.2.1-89.el8_6.20 +40
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) fence-agents-4.2.1-89.el8_6.20, fence-agents-all-4.2.1-89.el8_6.20, fence-agents-amt-ws-4.2.1-89.el8_6.20 +41
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) fence-agents-4.2.1-89.el8_6.20, fence-agents-all-4.2.1-89.el8_6.20, fence-agents-amt-ws-4.2.1-89.el8_6.20 +40
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.20, fence-agents-aws-4.2.1-89.el8_6.20, fence-agents-azure-arm-4.2.1-89.el8_6.20 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.20, fence-agents-aws-4.2.1-89.el8_6.20, fence-agents-azure-arm-4.2.1-89.el8_6.20 +1
  • RHSA-2026:1791 Released 2026-02-03 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) fence-agents-4.2.1-112.el8_8.15, fence-agents-all-4.2.1-112.el8_8.15, fence-agents-amt-ws-4.2.1-112.el8_8.15 +40
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) fence-agents-4.2.1-112.el8_8.15, fence-agents-all-4.2.1-112.el8_8.15, fence-agents-amt-ws-4.2.1-112.el8_8.15 +39
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.15, fence-agents-aws-4.2.1-112.el8_8.15, fence-agents-azure-arm-4.2.1-112.el8_8.15 +2
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.15, fence-agents-aws-4.2.1-112.el8_8.15, fence-agents-azure-arm-4.2.1-112.el8_8.15 +2
  • RHSA-2026:1794 Released 2026-02-03 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) resource-agents-4.9.0-40.el8_8.15, resource-agents-aliyun-4.9.0-40.el8_8.15, resource-agents-gcp-4.9.0-40.el8_8.15 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) resource-agents-4.9.0-40.el8_8.15, resource-agents-aliyun-4.9.0-40.el8_8.15, resource-agents-gcp-4.9.0-40.el8_8.15 +1
  • RHSA-2026:1793 Released 2026-02-03 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) resource-agents-4.9.0-16.el8_6.19, resource-agents-aliyun-4.9.0-16.el8_6.19, resource-agents-gcp-4.9.0-16.el8_6.19 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) resource-agents-4.9.0-16.el8_6.19, resource-agents-aliyun-4.9.0-16.el8_6.19, resource-agents-gcp-4.9.0-16.el8_6.19 +1
  • RHSA-2026:1735 Released 2026-02-02 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-agents-4.10.0-43.el9_2.18, fence-agents-common-4.10.0-43.el9_2.18, fence-agents-compute-4.10.0-43.el9_2.18 +11
    • Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.18, fence-agents-all-4.10.0-43.el9_2.18, fence-agents-amt-ws-4.10.0-43.el9_2.18 +40
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.18, fence-agents-all-4.10.0-43.el9_2.18, fence-agents-amt-ws-4.10.0-43.el9_2.18 +39
  • RHSA-2026:1734 Released 2026-02-02 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) fence-agents-4.10.0-20.el9_0.27, fence-agents-common-4.10.0-20.el9_0.27, fence-agents-compute-4.10.0-20.el9_0.27 +12
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.27, fence-agents-all-4.10.0-20.el9_0.27, fence-agents-amt-ws-4.10.0-20.el9_0.27 +40
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.27, fence-agents-all-4.10.0-20.el9_0.27, fence-agents-amt-ws-4.10.0-20.el9_0.27 +39
  • RHSA-2026:1736 Released 2026-02-02 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:1730 Released 2026-02-02 · Red Hat rating Important
    Red Hat Quay 3.12.13
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1729 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) python-urllib3-1.26.5-6.el9_6.1, python3-urllib3-1.26.5-6.el9_6.1
  • RHSA-2026:1726 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) python-urllib3-1.26.19-2.el10_0.1, python3-urllib3-1.26.19-2.el10_0.1
  • RHSA-2026:1717 Released 2026-02-02 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) fence-agents-4.10.0-62.el9_4.21, fence-agents-common-4.10.0-62.el9_4.21, fence-agents-compute-4.10.0-62.el9_4.21 +11
    • Red Hat Enterprise Linux High Availability EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.21, fence-agents-all-4.10.0-62.el9_4.21, fence-agents-amt-ws-4.10.0-62.el9_4.21 +40
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.21, fence-agents-all-4.10.0-62.el9_4.21, fence-agents-amt-ws-4.10.0-62.el9_4.21 +39
  • RHSA-2026:1712 Released 2026-02-02 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.11-urllib3-1.26.12-2.el9_4.3
  • RHSA-2026:1706 Released 2026-02-02 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-agents-4.10.0-86.el9_6.14, fence-agents-aliyun-4.10.0-86.el9_6.14, fence-agents-all-4.10.0-86.el9_6.14 +47
  • RHSA-2026:1704 Released 2026-02-02 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python3.11-urllib3-1.26.12-5.el9_6.1
  • RHSA-2026:1693 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) python-urllib3-1.26.5-3.el9_2.3, python3-urllib3-1.26.5-3.el9_2.3
  • RHSA-2026:1676 Released 2026-02-02 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) python3.11-urllib3-1.26.12-1.el8_8.3
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) python3.11-urllib3-1.26.12-1.el8_8.3
  • RHSA-2026:1674 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) python-urllib3-1.26.5-5.el9_4.3, python3-urllib3-1.26.5-5.el9_4.3
  • RHSA-2026:1652 Released 2026-02-02 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:1619 Released 2026-02-02 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python3.12-urllib3-1.26.19-1.el9_6.1
  • RHSA-2026:1618 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) python-urllib3-1.26.5-3.el9_0.2, python3-urllib3-1.26.5-3.el9_0.2
  • RHSA-2026:1609 Released 2026-01-30 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-chatbot-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8
  • RHSA-2026:1599 Released 2026-01-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.4 Container Release Update
    • Red Hat Ansible Automation Platform 2.4 registry.redhat.io/ansible-automation-platform-24/controller-rhel8, registry.redhat.io/ansible-automation-platform-24/lightspeed-rhel8
  • RHSA-2026:1596 Released 2026-01-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +7
  • RHSA-2026:1546 Released 2026-01-29 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) python3.11-urllib3-1.26.12-1.el9_2.2
  • RHSA-2026:1504 Released 2026-01-28 · Red Hat rating Important
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
  • RHSA-2026:1485 Released 2026-01-28 · Red Hat rating Important
    RHUI 4.11.3 security update - python-urllib3
    • RHUI 4 for RHEL 8 python-urllib3-2.6.3-1.el8ui, python3.11-urllib3-2.6.3-1.el8ui
  • RHSA-2026:1254 Released 2026-01-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) python-urllib3-1.24.2-9.el8_10, python3-urllib3-1.24.2-9.el8_10
  • RHSA-2026:1240 Released 2026-01-26 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-129.el8_10.20, fence-agents-all-4.2.1-129.el8_10.20, fence-agents-amt-ws-4.2.1-129.el8_10.20 +41
    • Red Hat Enterprise Linux HighAvailability (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.20, fence-agents-aws-4.2.1-129.el8_10.20, fence-agents-azure-arm-4.2.1-129.el8_10.20 +2
    • Red Hat Enterprise Linux ResilientStorage (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.20, fence-agents-aws-4.2.1-129.el8_10.20, fence-agents-azure-arm-4.2.1-129.el8_10.20 +2
  • RHSA-2026:1239 Released 2026-01-26 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-98.el9_7.4, fence-agents-aliyun-4.10.0-98.el9_7.4, fence-agents-all-4.10.0-98.el9_7.4 +47
  • RHSA-2026:1241 Released 2026-01-26 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) resource-agents-4.9.0-54.el8_10.27, resource-agents-aliyun-4.9.0-54.el8_10.27, resource-agents-gcp-4.9.0-54.el8_10.27 +1
    • Red Hat Enterprise Linux ResilientStorage (v. 8) resource-agents-4.9.0-54.el8_10.27, resource-agents-aliyun-4.9.0-54.el8_10.27, resource-agents-gcp-4.9.0-54.el8_10.27 +1
  • RHSA-2026:1226 Released 2026-01-26 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-urllib3-1.26.19-2.el8_10
  • RHSA-2026:1224 Released 2026-01-26 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.11-urllib3-1.26.12-6.el8_10
  • RHSA-2026:1088 Released 2026-01-26 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-urllib3-1.26.19-1.el9_7.1
  • RHSA-2026:1089 Released 2026-01-26 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.11-urllib3-1.26.12-5.el9_7.1
  • RHSA-2026:1087 Released 2026-01-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 9) python-urllib3-1.26.5-6.el9_7.1, python3-urllib3-1.26.5-6.el9_7.1
  • RHSA-2026:1086 Released 2026-01-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 10) python-urllib3-1.26.19-2.el10_1.1, python3-urllib3-1.26.19-2.el10_1.1
  • RHSA-2026:1176 Released 2026-01-26 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:1168 Released 2026-01-26 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:1166 Released 2026-01-26 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:1042 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:1041 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:1038 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:0990 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:0981 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
External Secrets Operator for Red Hat OpenShiftAffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Migration Toolkit for ContainersAffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
Multiarch Tuning OperatorAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ansible Automation Platform Ansible Core 2AffectedNo fix yet
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix planned: Will not fix
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Red Hat Edge Manager previewAffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Zero Trust Workload Identity Manager - Tech PreviewAffectedNo fix planned: Will not fix
Cert Manager support for Red Hat OpenShift release 1.18Fixed RHSA-2026:0981, RHSA-2026:0990, RHSA-2026:1038, RHSA-2026:1041, RHSA-2026:1042, RHSA-2026:1166, RHSA-2026:1168, RHSA-2026:1176
Multicluster Global Hub 1.4.9Fixed RHSA-2026:2500
Multicluster Global Hub 1.5.8Fixed RHSA-2026:2256
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:2900
OpenShift API for Data Protection 1.3Fixed RHSA-2026:3444
RHUI 4 for RHEL 8Fixed RHSA-2026:1485
Red Hat AI Inference Server 3.2Fixed RHSA-2026:3461, RHSA-2026:3462, RHSA-2026:61628
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:25127
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:8151
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:4466
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:4467
Red Hat Ansible Automation Platform 2.4Fixed RHSA-2026:1599
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:1609
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:1596, RHSA-2026:3960
Red Hat Ceph Storage 7.1Fixed RHSA-2026:33154
Red Hat Ceph Storage 8Fixed RHSA-2026:1652
Red Hat Ceph Storage 9Fixed RHSA-2026:3406
Red Hat Ceph Storage 9.2Fixed RHSA-2026:86618
Red Hat Discovery 2Fixed RHSA-2026:1736
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:1224, RHSA-2026:1226, RHSA-2026:1240
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:1088, RHSA-2026:1089, RHSA-2026:1239
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:1803
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:1792
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:1792
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:1676, RHSA-2026:1791
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:1734
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:1546, RHSA-2026:1735
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:1712, RHSA-2026:1717, RHSA-2026:1957
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:1619, RHSA-2026:1704, RHSA-2026:1706
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:1803
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:1792
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:1676, RHSA-2026:1791
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:1086
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:1254
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:1087
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2026:2728
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:2723
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:2717
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:2717
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:2718
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:1618
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:1693
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:1726
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:1674
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:1729
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:2723
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:2717
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:2718
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2026:1803, RHSA-2026:1805
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2026:1792, RHSA-2026:1793
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2026:1791, RHSA-2026:1794
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2026:1734
Red Hat Enterprise Linux High Availability E4S (v.9.2)Fixed RHSA-2026:1735
Red Hat Enterprise Linux High Availability EUS (v.9.4)Fixed RHSA-2026:1717
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2026:1792, RHSA-2026:1793
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2026:1791, RHSA-2026:1794
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2026:1240, RHSA-2026:1241
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2026:1803, RHSA-2026:1805
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)Fixed RHSA-2026:1735
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)Fixed RHSA-2026:1717
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2026:1240, RHSA-2026:1241
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2026:1734
Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS)Fixed RHSA-2026:2911
Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS)Fixed RHSA-2026:2911
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184, RHSA-2026:2106, RHSA-2026:2695, RHSA-2026:3782
Red Hat OpenShift AI 3.3Fixed RHSA-2026:19712, RHSA-2026:3713
Red Hat OpenShift Dev Spaces (RHOSDS) 3.26Fixed RHSA-2026:2456
Red Hat OpenShift GitOps 1.17Fixed RHSA-2026:3869
Red Hat OpenShift GitOps 1.18Fixed RHSA-2026:3874
Red Hat OpenShift GitOps 1.19Fixed RHSA-2026:3884
Red Hat OpenStack Platform 17.1Fixed RHSA-2026:28043
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:92650
Red Hat Quay 3.10Fixed RHSA-2026:2762
Red Hat Quay 3.12Fixed RHSA-2026:1730
Red Hat Quay 3.13Fixed RHSA-2026:4185
Red Hat Quay 3.14Fixed RHSA-2026:4215
Red Hat Quay 3.15Fixed RHSA-2026:1942
Red Hat Quay 3.16Fixed RHSA-2026:2681
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:2765
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:2765
Red Hat Satellite 6.17Fixed RHSA-2026:44696
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:2764
Red Hat Satellite 6.18Fixed RHSA-2026:14877, RHSA-2026:1504, RHSA-2026:51357, RHSA-2026:6287, RHSA-2026:6292, RHSA-2026:8500, RHSA-2026:8501
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:2760
Red Hat Trusted Artifact Signer 1.2Fixed RHSA-2026:2919, RHSA-2026:2924, RHSA-2026:2925, RHSA-2026:2926
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:2126, RHSA-2026:2137, RHSA-2026:2139, RHSA-2026:2144, RHSA-2026:3296, RHSA-2026:4271, RHSA-2026:5459
Red Hat Update Infrastructure 5Fixed RHSA-2026:2563
Zero Trust Workload Identity Manager 1.0Fixed RHSA-2026:17456, RHSA-2026:17457, RHSA-2026:17460, RHSA-2026:17461, RHSA-2026:17462, RHSA-2026:17463
mirror registry for Red Hat OpenShift 2.0Fixed RHSA-2026:28441
Not affected: 75 products
  • Assisted Installer for Red Hat OpenShift Container Platform 2
  • Cert Manager support for Red Hat OpenShift release 1.18
  • Confidential Compute Attestation
  • Dynamic Accelerator Slicer Operator for Red Hat OpenShift
  • External Secrets Operator for Red Hat OpenShift
  • Fence Agents Remediation Operator
  • Migration Toolkit for Virtualization
  • Multicluster Engine for Kubernetes
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Network Observability (NETOBSERV) 1.11.0
  • Node HealthCheck Operator
  • OpenShift API for Data Protection
  • OpenShift API for Data Protection 1.3
  • OpenShift Pipelines
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.4
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ceph Storage 7.1
  • Red Hat Ceph Storage 8
  • Red Hat Ceph Storage 9
  • Red Hat Ceph Storage 9.2
  • Red Hat Connectivity Link 1
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Migration Toolkit 1.8
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.17
  • Red Hat OpenShift GitOps 1.18
  • Red Hat OpenShift GitOps 1.19
  • Red Hat OpenShift Update Service
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Quay 3
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.13
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Satellite 6
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Trusted Artifact Signer 1.2
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat build of Quarkus Native builder
  • Self Node Remediation Operator
  • Service Telemetry Framework 1.5
  • Zero Trust Workload Identity Manager - Tech Preview
  • external secrets operator for Red Hat OpenShift - Tech Preview

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21441
  2. 2026-10-03 Alias added: GHSA-38jv-5279-wg99
  3. 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.18 · Red Hat
  4. 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
  5. 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat
  6. 2026-10-27 Affected versions changed · Red Hat
  7. 2026-10-30 Fix available: Red Hat Openshift Data Foundation 4.19 · Red Hat
  8. 2026-10-31 Fix available: RHSA-2026:92650 · Red Hat
  9. 2026-11-06 Fix available: RHSA-2026:2717 · Red Hat
  10. 2026-11-06 Fix available: RHSA-2026:2728 · Red Hat
  11. 2026-11-06 Fix available: RHSA-2026:2919 · Red Hat

References

Patch 1

Advisory 2

Other 2

  • TI-2018-14221 urllib3 before version 1.23 does not remove the Authorization HTTP header when following… CVSS 3.0CRITICAL 9.8
  • TI-2025-40854 urllib3 allows an unbounded number of links in the decompression chain CVSS 4.0HIGH 8.9
  • TI-2026-32373 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CVSS 4.0HIGH 8.9
  • TI-2025-40898 urllib3 Streaming API improperly handles highly compressed data CVSS 4.0HIGH 8.9
  • TI-2021-12905 An issue was discovered in urllib3 before 1.26.5. CVSS 3.1HIGH 7.5
  • TI-2020-05823 The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through… CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences