RHBA-2026:85192 - Bug Fix Advisory

Topic

This erratum covers updates to the current Red Hat JBoss Web Server 6.2 for OpenShift images to fix libtiff, libxml2, expat, rsync, gdb-gdbserver, and pcre2 CVEs.

Description

Red Hat xPaaS provides images for many of the Red Hat Middleware products that are available for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments.

The current JBoss Web Server 6.2 for OpenShift images have been updated to fix the following CVEs:

• libtiff: libtiff: Arbitrary code execution via process_command_opts() function (CVE-2026-52490)
• libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)
• libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)
• libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140)
• libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144)
• libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)
• expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046)
• expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)
• rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
• rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
• rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
• rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
• rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
• rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
• rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
• rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)
• rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
• rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
• rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
• rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
• rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
• rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
• rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
• rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
• rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)
• gdb: STABS debug format parser out-of-bounds write via crafted ELF binary (CVE-2026-13732)
• pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)
• pcre2: PCRE2: Out-of-bounds write via large pattern input (CVE-2026-89157)
• PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms (CVE-2026-89158)
• pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)

Solution

To update to the latest JBoss Web Server 6.2.5 for OpenShift image on UBI8, perform the following steps to pull in the content:

1. On your master host(s), ensure that you are logged in to the command line interface as a cluster administrator or user who has project administrator access to the global "openshift" project:

$ oc login -u system:admin

2. Depending on the OpenJDK version, run one of the following commands to update the core JBoss Web Server 6.2 tomcat 10 OpenShift image stream in the "openshift" project:

• For OpenJDK 17:

To update the core JBoss Web Server 6.2 tomcat 10 with OpenJDK 17 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver62-openjdk17-tomcat10-openshift-ubi8:6.2.5

• For OpenJDK 21:

To update the core JBoss Web Server 6.2 tomcat 10 with OpenJDK 21 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver62-openjdk21-tomcat10-openshift-ubi8:6.2.5

Affected Products

• Red Hat OpenShift Container Platform 4.12 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.11 for RHEL 8 x86_64

Fixes

• BZ - 2528993 - CVE-2026-86145 pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions
• BZ - 2531744 - CVE-2026-89157 pcre2: PCRE2: Out-of-bounds write via large pattern input
• BZ - 2531746 - CVE-2026-89158 PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms
• BZ - 2543797 - CVE-2026-103111 pcre2: pcre2: Out-of-bounds write via crafted regular expression

CVEs

• CVE-2025-5278
• CVE-2025-45582
• CVE-2025-49506
• CVE-2026-5704
• CVE-2026-13732
• CVE-2026-15711
• CVE-2026-18374
• CVE-2026-18477
• CVE-2026-18508
• CVE-2026-19542
• CVE-2026-32327
• CVE-2026-34501
• CVE-2026-34502
• CVE-2026-40467
• CVE-2026-40468
• CVE-2026-52490
• CVE-2026-53783
• CVE-2026-53784
• CVE-2026-53785
• CVE-2026-53789
• CVE-2026-53790
• CVE-2026-53793
• CVE-2026-53795
• CVE-2026-53802
• CVE-2026-53803
• CVE-2026-66046
• CVE-2026-70452
• CVE-2026-70453
• CVE-2026-70456
• CVE-2026-70458
• CVE-2026-70460
• CVE-2026-70461
• CVE-2026-70463
• CVE-2026-70464
• CVE-2026-73073
• CVE-2026-77117
• CVE-2026-80489
• CVE-2026-86142
• CVE-2026-86145
• CVE-2026-89157
• CVE-2026-89158
• CVE-2026-93990
• CVE-2026-103111

References

• https://access.redhat.com/errata/RHSA-2026:81613
• https://access.redhat.com/containers