Red Hat Product Errata RHSA-2026:67595 - Security Advisory
Issued:
2026-09-15
Updated:
2026-09-15

RHSA-2026:67595 - Security Advisory

Synopsis

Important: goose bug fix and enhancement update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for goose is now available for Red Hat Enterprise Linux 9.

Description

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Security Fix(es):

  • goose: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON (CVE-2026-18140)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

(none)

Red Hat Enterprise Linux for x86_64 9

SRPM
goose-1.38.0-1.el9_8.src.rpm SHA-256: 106c02438edbcc57aa8c1bba577aa2d93129bec1b3744536f230f873706a6963
x86_64
goose-1.38.0-1.el9_8.x86_64.rpm SHA-256: 16bbc6aa820f634a7d11639bc3c84ef2dd7732b18c9ae96a7a108762e69e4777
goose-debuginfo-1.38.0-1.el9_8.x86_64.rpm SHA-256: f7bcee9992dd02ec3b222b40f89df45615db1b6647603b89afc72644799d013e
goose-debugsource-1.38.0-1.el9_8.x86_64.rpm SHA-256: 0bbf0fa040a79549f16deab2852aee02b4898f50006170a184517492dfd6de61

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
goose-1.38.0-1.el9_8.src.rpm SHA-256: 106c02438edbcc57aa8c1bba577aa2d93129bec1b3744536f230f873706a6963
s390x
goose-1.38.0-1.el9_8.s390x.rpm SHA-256: 546287db5f9789173b6c3dfe5d8be19d2c42ed0a3b9019a4276132b3ddc34c82
goose-debuginfo-1.38.0-1.el9_8.s390x.rpm SHA-256: b057eac9106cbca174668a6613ea67ec57b23ae372191fd44993681e335042c7
goose-debugsource-1.38.0-1.el9_8.s390x.rpm SHA-256: 69cb51018ea85b4d10ca01b47b3351d5083ce97eba684f500fed9bceda084113

Red Hat Enterprise Linux for Power, little endian 9

SRPM
goose-1.38.0-1.el9_8.src.rpm SHA-256: 106c02438edbcc57aa8c1bba577aa2d93129bec1b3744536f230f873706a6963
ppc64le
goose-1.38.0-1.el9_8.ppc64le.rpm SHA-256: a104f3737050d33ac1073de329306adc06206cde7e1e10727965a4eca2767c9f
goose-debuginfo-1.38.0-1.el9_8.ppc64le.rpm SHA-256: 2234e959da4bd52b527c1bcc38b20274801a74cb020f6e566be3e66e201c4e0c
goose-debugsource-1.38.0-1.el9_8.ppc64le.rpm SHA-256: 78243738acbedfd752fd5f37cd3a3cc4afd6df5696d61828f5b230c41dae6423

Red Hat Enterprise Linux for ARM 64 9

SRPM
goose-1.38.0-1.el9_8.src.rpm SHA-256: 106c02438edbcc57aa8c1bba577aa2d93129bec1b3744536f230f873706a6963
aarch64
goose-1.38.0-1.el9_8.aarch64.rpm SHA-256: 946936be7c3657babdf8ce80e217f29e00d8fb725b7c065f8afcf237614de781
goose-debuginfo-1.38.0-1.el9_8.aarch64.rpm SHA-256: 09b9c2d8b0699117151b23cc90e557ae17044630ed57502705e886afe5a7439c
goose-debugsource-1.38.0-1.el9_8.aarch64.rpm SHA-256: c7c8c06248db483929f45991af36a257251b23551b58b91bd1508e7179bb980c

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.