Red Hat Product Errata RHSA-2026:67593 - Security Advisory
Issued:
2026-09-15
Updated:
2026-09-15

RHSA-2026:67593 - Security Advisory

Synopsis

Important: goose bug fix and enhancement update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for goose is now available for Red Hat Enterprise Linux 10.

Description

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Security Fix(es):

  • goose: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON (CVE-2026-18140)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 10 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 10 s390x
  • Red Hat Enterprise Linux for Power, little endian 10 ppc64le
  • Red Hat Enterprise Linux for ARM 64 10 aarch64

Fixes

(none)

Red Hat Enterprise Linux for x86_64 10

SRPM
goose-1.38.0-1.el10_2.src.rpm SHA-256: 0c691484f58c614cc5688e85ebc5e5dcad18c33f8f6693c35fd9e3e22dd77197
x86_64
goose-1.38.0-1.el10_2.x86_64.rpm SHA-256: 4cb79b66d38debc9e7da72fc8a7dbe277c0ae71240a99d8dc70c4316b92c8f3b
goose-debuginfo-1.38.0-1.el10_2.x86_64.rpm SHA-256: 7ad338da21f54c32606980c329b4e1dfc7c61f4d8eb3cff6921931dc0f97dfef
goose-debugsource-1.38.0-1.el10_2.x86_64.rpm SHA-256: 5f07cfedf924a7eb1261bd408beded67b4368ccaa00a291bae84ade1482a1d69

Red Hat Enterprise Linux for IBM z Systems 10

SRPM
goose-1.38.0-1.el10_2.src.rpm SHA-256: 0c691484f58c614cc5688e85ebc5e5dcad18c33f8f6693c35fd9e3e22dd77197
s390x
goose-1.38.0-1.el10_2.s390x.rpm SHA-256: 3f6c18483ff75e2a78194ef056e78b383c1154b1efb2a567f874c2191eef3f0d
goose-debuginfo-1.38.0-1.el10_2.s390x.rpm SHA-256: 927d3e82ed4b5e499baf8a6ac6ed9243aea1ebeee3b3369bec856bb9c5d9655b
goose-debugsource-1.38.0-1.el10_2.s390x.rpm SHA-256: 10b652106f8bf8b560d769624f41416f239dcc4b775b0d0ef3a10f478628d0db

Red Hat Enterprise Linux for Power, little endian 10

SRPM
goose-1.38.0-1.el10_2.src.rpm SHA-256: 0c691484f58c614cc5688e85ebc5e5dcad18c33f8f6693c35fd9e3e22dd77197
ppc64le
goose-1.38.0-1.el10_2.ppc64le.rpm SHA-256: 6666a207d11ea551fa9bd2400a195a2bf4b6d1ca6cf960057a8475d172f68650
goose-debuginfo-1.38.0-1.el10_2.ppc64le.rpm SHA-256: 25812b53eb045881f6f66a73bdda9cbceb5be96f09f13b73d2f410ead43db423
goose-debugsource-1.38.0-1.el10_2.ppc64le.rpm SHA-256: 3af519edd5b68d22df6f81d8d297251941b61ca2908a02523ff5ee53c51afdaf

Red Hat Enterprise Linux for ARM 64 10

SRPM
goose-1.38.0-1.el10_2.src.rpm SHA-256: 0c691484f58c614cc5688e85ebc5e5dcad18c33f8f6693c35fd9e3e22dd77197
aarch64
goose-1.38.0-1.el10_2.aarch64.rpm SHA-256: f55cecd144433609440df0c6698a41c22b7e5c93d5802cdefd0fe1d5b3c4cfcc
goose-debuginfo-1.38.0-1.el10_2.aarch64.rpm SHA-256: bbba0544972064c48dee6317fae0b48598d505e7deaba320d3332e06806bf8a9
goose-debugsource-1.38.0-1.el10_2.aarch64.rpm SHA-256: f56b9777eaa9b8d780b1c5e3ee2ecceac450951216180df1e86b4085c39ff256

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.