RHSA-2026:58474MediumCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
August 22, 2026
Last Modified
September 6, 2026

🔗 CVE IDs covered (4)

CVE-2025-49506 →CVE-2026-32327 →CVE-2026-34501 →CVE-2026-34502 →

📋 Description

CVE-2025-49506 — apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2026-32327 — apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack CVE-2026-34501 — apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client CVE-2026-34502 — apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

🎯 Affected products4

  • Red Hat Hardened Images
  • apr-util-main@aarch64 as a component of Red Hat Hardened Images
  • apr-util-main@src as a component of Red Hat Hardened Images
  • apr-util-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Ensure that the Redis server used by the application is deployed in a trusted, network-segregated environment and is not accessible to untrusted parties. Where possible, configure authentication and TLS on the Redis connection to reduce the risk of a compromised or spoofed Redis server. Workaround: Restrict network access for applications that use the `apr-util` memcached client to communicate only with trusted memcached servers. Ensure that Red Hat products are configured to avoid connecting to untrusted or publicly exposed memcached instances. If the memcached client functionality is not essential, consider disabling or removing any dependent components. A service restart may be required for changes to take effect.

🔗 References (8)