RHSA-2026:92858 - Security Advisory

Topic

A security update for Red Hat Satellite is now available.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

This advisory provides security fixes for affected packages used by Red Hat Satellite. The updates address the vulnerabilities described below.

Security Fix(es):

• yggdrasil-worker-forwarder: Denial of Service via malformed RPC requests in gRPC-Go (CVE-2026-84445)
• yggdrasil-worker-forwarder: Denial of Service via multiple ECH outer extension references in crypto/tls (CVE-2026-97031)
• yggdrasil-worker-forwarder: Denial of Service via crafted HTTP Range headers in Go (CVE-2026-78667)
• yggdrasil-worker-forwarder: Denial of Service via excessive HTTP/2 SETTINGS frames in net/http (CVE-2026-78669)
• yggdrasil-worker-forwarder: Man-in-the-middle attacks via untrusted intermediate certificates in crypto/x509 (CVE-2026-111943)
• openvox-server: Denial of Service via unchecked DTLS handshake reassembler buffer allocation in Bouncy Castle for Java (CVE-2026-59646)
• openvox-server: CPU Denial of Service via unbounded numeric parsing in jackson-databind (CVE-2026-68497)
• openvox-server: HTTP request smuggling via crafted chunked requests in Jetty (CVE-2026-19203)
• openvox-server: Denial of Service via regular expression backtracking in jackson-core (CVE-2026-89407)
• openvox-server: Denial of Service via unbounded StringBuilder growth during malformed token processing in jackson-core (CVE-2026-89425)
• openvox-server: Access control bypass via case-sensitive host filtering in Eclipse Jetty (CVE-2026-18660)
• openvox-agent: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)
• openvox-agent: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)
• openvox-agent: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
• puppet-agent: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
• puppet-agent: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)
• puppetserver: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
• puppetserver: Jetty: HTTP request smuggling via crafted chunked requests (CVE-2026-19203)
• puppetserver: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)
• yggdrasil-worker-forwarder: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)
• openvox-server: jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
• yggdrasil-worker-forwarder: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index

Release Notes:

Provisioning tokens are now required for all Operating System entries with Redhat family set. Attempts to download a unattended template without valid token will lead to “a provisioning token is required but a valid one was not provided” error.

This changed behavior will lead to inability to use Generic or Subnet Bootdisks, systems using this bootdiks will be not matched with the host entry and not boot. To use Bootdisk after applying the errata, either use Full Host Bootdisk which uses tokens, or set Administer - Settings - Provisioning - Installation token lifetime to zero. This turns off the token enforcement and allows unauthenticated parties to use arbitrary MAC addresses in unattended requests to fetch provisioning kickstart with possibly sensitive data.

Affected Products

• Red Hat Satellite Extended Update Support 6.16 for RHEL 9 x86_64
• Red Hat Satellite Extended Update Support 6.16 for RHEL 8 x86_64
• Red Hat Satellite Capsule Extended Update Support 6.16 for RHEL 9 x86_64
• Red Hat Satellite Capsule Extended Update Support 6.16 for RHEL 8 x86_64

Fixes

• BZ - 2496765 - CVE-2026-8924 curl: curl: Cookie injection via malicious HTTP server using super cookies
• BZ - 2504233 - CVE-2026-56852 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
• BZ - 2510193 - CVE-2026-59646 org.bouncycastle/bc-java: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation
• BZ - 2511026 - CVE-2026-68494 com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
• BZ - 2517560 - CVE-2026-63072 openssl: heap buffer overflow in CMS key unwrapping
• BZ - 2517561 - CVE-2026-63076 openssl: invalid pointer dereference in CMP server via crafted protectionAlg
• BZ - 2529768 - CVE-2026-19203 org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests
• BZ - 2531964 - CVE-2026-68497 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing
• BZ - 2533175 - CVE-2026-84445 google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests
• BZ - 2538720 - CVE-2026-89407 com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking
• BZ - 2539084 - CVE-2026-89425 com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing
• BZ - 2548334 - CVE-2026-78667 net/http: golang: golang: Denial of Service via crafted HTTP Range headers
• BZ - 2548336 - CVE-2026-97031 crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references
• BZ - 2548341 - CVE-2026-94440 net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing
• BZ - 2548344 - CVE-2026-78669 net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
• BZ - 2553134 - CVE-2026-18660 org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering
• BZ - 2556068 - CVE-2026-111943 crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

CVEs

• CVE-2026-8924
• CVE-2026-18660
• CVE-2026-19203
• CVE-2026-56852
• CVE-2026-59646
• CVE-2026-63072
• CVE-2026-63076
• CVE-2026-68494
• CVE-2026-68497
• CVE-2026-78667
• CVE-2026-78669
• CVE-2026-84445
• CVE-2026-89407
• CVE-2026-89425
• CVE-2026-94440
• CVE-2026-97031
• CVE-2026-111943

References

• https://access.redhat.com/security/updates/classification/#important