RHSA-2026:95124HighCVSS 7.5

Red Hat Security Advisory: RHTAS 1.5.1 - Red Hat Trusted Artifact Signer Release

Published
November 4, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (10)

CVE-2026-109924 →CVE-2026-87029 →CVE-2026-109932 →CVE-2026-19534 →CVE-2026-33818 →CVE-2026-87018 →CVE-2026-109383 →CVE-2026-109829 →CVE-2026-109841 →CVE-2026-109869 →

📋 Description

CVE-2026-19534 — undici: undici: Denial of Service via unrequested WebSocket subprotocol CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-87018 — undici: undici: Denial of Service via TLS renegotiation with mismatched certificate CVE-2026-87029 — undici: undici: Denial of Service via unhandled exception in decompress interceptor CVE-2026-109383 — undici: undici: Certificate validation bypass via dropped TLS options in Agent CVE-2026-109829 — undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching CVE-2026-109841 — undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens CVE-2026-109869 — undici: undici: Denial of Service via unhandled stream error on excessive content encodings CVE-2026-109924 — undici: undici: Denial of Service via memory exhaustion in EventSource client CVE-2026-109932 — undici: undici: Denial of Service via unbounded WebSocket PONG buffering

🎯 Affected products3

  • Red Hat Trusted Artifact Signer 1.5
  • registry.redhat.io/rhtas/rhtas-console-rhel9@sha256:307eae05675319fdeed338d20b226740091487b11976f1028456ce13c4436242_amd64 as a component of Red Hat Trusted Artifact Signer 1.5
  • registry.redhat.io/rhtas/rhtas-console-ui-rhel9@sha256:a64fb9fcd91eee9dd28e939fd06c90655d2d0f8ee29f99de65123bd838574b7b_amd64 as a component of Red Hat Trusted Artifact Signer 1.5

✅ Remediation

Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (15)