RHSA-2026:40415HighCVSS 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
July 15, 2026
Last Modified
September 10, 2026

🔗 CVE IDs covered (2)

CVE-2026-53486 →CVE-2026-59869 →

📋 Description

CVE-2026-53486 — decompress: @xhmikosr/decompress: Decompress: Arbitrary file read/write via crafted archive extraction CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents

🎯 Affected products4

  • Red Hat Hardened Images
  • dotnet8-0-main@aarch64 as a component of Red Hat Hardened Images
  • dotnet8-0-main@src as a component of Red Hat Hardened Images
  • dotnet8-0-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: There is no upstream fix for the original, unmaintained decompress npm package used by these components (last release 4.2.1). The maintained fork, @xhmikosr/decompress, resolves this issue in versions 10.2.1 and 11.1.3, but is not used by any affected Red Hat component. As a general mitigation, only extract archives from trusted sources with the affected tooling, run extraction as a non-root user to prevent the setuid/setgid/sticky-bit issue from creating a privileged file, and verify that any symlinks or hardlinks produced by extraction resolve inside the intended output directory. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.

🔗 References (6)