RHSA-2026:92859 - Security Advisory

Topic

A security update for Red Hat Satellite 6.17 is now available.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.

Description

• openvox-agent: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924).
• openvox-agent: heap buffer overflow in CMS key unwrapping (CVE-2026-63072).
• openvox-agent: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076).
• openvox-server: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation (CVE-2026-59646).
• openvox-server: Eclipse Jetty: Access control bypass via case-sensitive host filtering (CVE-2026-18660).
• openvox-server: jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494).
• openvox-server: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407).
• openvox-server: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425).
• openvox-server: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497).
• openvox-server: Jetty: HTTP request smuggling via crafted chunked requests (CVE-2026-19203).
• puppet-agent: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924).
• puppet-agent: heap buffer overflow in CMS key unwrapping (CVE-2026-63072).
• puppet-agent: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076).
• puppetserver: Eclipse Jetty: Access control bypass via case-sensitive host filtering (CVE-2026-18660).
• puppetserver: jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494).
• puppetserver: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407).
• puppetserver: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497).
• puppetserver: Jetty: HTTP request smuggling via crafted chunked requests (CVE-2026-19203).
• satellite/iop-vmaas-rhel9: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852).
• yggdrasil-worker-forwarder: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031).
• yggdrasil-worker-forwarder: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943).
• yggdrasil-worker-forwarder: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667).
• yggdrasil-worker-forwarder: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440).
• yggdrasil-worker-forwarder: gRPC-Go: Denial of Service via malformed RPC requests (CVE-2026-84445).
• yggdrasil-worker-forwarder: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669).

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Satellite 6.17 x86_64
• Red Hat Satellite Capsule 6.17 x86_64

Fixes

• BZ - 2496765 - CVE-2026-8924 curl: curl: Cookie injection via malicious HTTP server using super cookies
• BZ - 2504233 - CVE-2026-56852 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
• BZ - 2510193 - CVE-2026-59646 org.bouncycastle/bc-java: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation
• BZ - 2511026 - CVE-2026-68494 com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
• BZ - 2517560 - CVE-2026-63072 openssl: heap buffer overflow in CMS key unwrapping
• BZ - 2517561 - CVE-2026-63076 openssl: invalid pointer dereference in CMP server via crafted protectionAlg
• BZ - 2529768 - CVE-2026-19203 org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests
• BZ - 2531964 - CVE-2026-68497 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing
• BZ - 2533175 - CVE-2026-84445 google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests
• BZ - 2538720 - CVE-2026-89407 com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking
• BZ - 2539084 - CVE-2026-89425 com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing
• BZ - 2548334 - CVE-2026-78667 net/http: golang: golang: Denial of Service via crafted HTTP Range headers
• BZ - 2548336 - CVE-2026-97031 crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references
• BZ - 2548341 - CVE-2026-94440 net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing
• BZ - 2548344 - CVE-2026-78669 net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
• BZ - 2553134 - CVE-2026-18660 org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering
• BZ - 2556068 - CVE-2026-111943 crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

CVEs

• CVE-2026-8924
• CVE-2026-18660
• CVE-2026-19203
• CVE-2026-56852
• CVE-2026-59646
• CVE-2026-63072
• CVE-2026-63076
• CVE-2026-68494
• CVE-2026-68497
• CVE-2026-78667
• CVE-2026-78669
• CVE-2026-84445
• CVE-2026-89407
• CVE-2026-89425
• CVE-2026-94440
• CVE-2026-97031
• CVE-2026-111943

References

• https://access.redhat.com/security/updates/classification/#important