RHSA-2026:95652 - Security Advisory

Topic

A security update for Red Hat Satellite 6.19 is now available.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE links in the References section.

Description

This advisory provides security fixes for affected packages used by Red Hat
Satellite. The updates address the vulnerabilities described below.

Security Fix(es):

• openvox-agent: Integer overflow when compiling a specially crafted

regular expression (CVE-2026-110264).

• openvox-agent: Integer overflow when compiling a specially crafted CI/CD

regular expression (CVE-2026-97229).

• openvox-agent: Integer overflow when compiling a specially crafted

regular expression (CVE-2026-93577).

• openvox-agent: Double free when parsing a specially crafted regular

expression (CVE-2026-89078).

• openvox-server: Authenticated remote code execution via report event

deserialization (CVE-2026-115731).

• openvox-server: Certificate name authorization bypass via flawed hostname

ACL matching (CVE-2026-115732).

• openvox-server: Denial of Service via unbounded memory allocation in

asynchronous parser (CVE-2026-104895).

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://docs.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index

Affected Products

• Red Hat Satellite 6.19 x86_64
• Red Hat Satellite Capsule 6.19 x86_64

Fixes

CVEs

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-104895
• CVE-2026-110264
• CVE-2026-115731
• CVE-2026-115732

References

• https://access.redhat.com/security/updates/classification/#critical