Red Hat Product Errata RHSA-2026:98482 - Security Advisory
Issued:
2026-11-11
Updated:
2026-11-11

RHSA-2026:98482 - Security Advisory

Synopsis

Important: librsvg2 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for librsvg2 is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.

Security Fix(es):

  • librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2539279 - CVE-2026-96889 librsvg: Use-after-free when XML includes have duplicated entities

Red Hat Enterprise Linux for x86_64 9

SRPM
librsvg2-2.50.7-3.el9_9.1.src.rpm SHA-256: 38c3bb5dde4215d8ddae7cbc3855bcac713043802edd0519fa90af30be8a01ba
x86_64
librsvg2-2.50.7-3.el9_9.1.i686.rpm SHA-256: c5964cdb96d353aae4381dcbb8b16aaa85e77bd2999604f237e9e08efeb43c75
librsvg2-2.50.7-3.el9_9.1.x86_64.rpm SHA-256: 642febc024866bb4fe6df97d96d6e647671cbcaef50e00c862ef872ce602ae97
librsvg2-debuginfo-2.50.7-3.el9_9.1.i686.rpm SHA-256: 05deb0bd4dcf43ca953a9ef3c5c4bf434873baf5bf3a8593023242e512e5faf3
librsvg2-debuginfo-2.50.7-3.el9_9.1.x86_64.rpm SHA-256: f4c4f99bb728fd2602fb97720a559a13ca30bfea648f52c3fd30280cd76a0036
librsvg2-debugsource-2.50.7-3.el9_9.1.i686.rpm SHA-256: e4f267b60d4053438b758486be3bfea31902b00ff271decdcd680e90c2161010
librsvg2-debugsource-2.50.7-3.el9_9.1.x86_64.rpm SHA-256: 638b07c04acc031ce390514151a03d2c92328884d88fd45b2109018d494a1af5
librsvg2-devel-2.50.7-3.el9_9.1.i686.rpm SHA-256: f08b624149a2254b9f199b603a3a1bad87b2f9049de14e72916777c8a551658c
librsvg2-devel-2.50.7-3.el9_9.1.x86_64.rpm SHA-256: ab71593edf8f902a0b4c7f4e7a5aec6341e9621e892c53ace32aca8ea52b19ab
librsvg2-tools-2.50.7-3.el9_9.1.x86_64.rpm SHA-256: dd85e499890ccd736313302631693c6298a3bb6fbe961502c04fc6dfe83e430e
librsvg2-tools-debuginfo-2.50.7-3.el9_9.1.i686.rpm SHA-256: b9a906196941ded6dcac1e3999b70989503d03eb245122ee54bce1695878b758
librsvg2-tools-debuginfo-2.50.7-3.el9_9.1.x86_64.rpm SHA-256: e9e429f1791b98ae7677d4a316bddf895715cb5d4af79a5e36d8f57e6ba73ed8

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
librsvg2-2.50.7-3.el9_9.1.src.rpm SHA-256: 38c3bb5dde4215d8ddae7cbc3855bcac713043802edd0519fa90af30be8a01ba
s390x
librsvg2-2.50.7-3.el9_9.1.s390x.rpm SHA-256: 208c4123271a39d56f673f7919813c3b9e24f39e1b5be7765d7c550b5128b90b
librsvg2-debuginfo-2.50.7-3.el9_9.1.s390x.rpm SHA-256: 37a6f135458e9bcc0e1ec7561e469da33c273ec9fad10615d8ee8492bf83d627
librsvg2-debugsource-2.50.7-3.el9_9.1.s390x.rpm SHA-256: 0cf2b890dd47c741e7e253e39932ced0e72a03f0eb4d59213fb032664d8999c6
librsvg2-devel-2.50.7-3.el9_9.1.s390x.rpm SHA-256: 8ef9d2f4f7f097a9f62c564b87e43f5b795cc802a8c2ed4fc20d9a9a6e09b163
librsvg2-tools-2.50.7-3.el9_9.1.s390x.rpm SHA-256: a05fec475a28e80e321cac71dd3731fce92a978b7d8d70a7a2cea0788fae3aad
librsvg2-tools-debuginfo-2.50.7-3.el9_9.1.s390x.rpm SHA-256: 7e21110de78207315f929efd99d7dbde1244628ee26de2e1e78fce768b855994

Red Hat Enterprise Linux for Power, little endian 9

SRPM
librsvg2-2.50.7-3.el9_9.1.src.rpm SHA-256: 38c3bb5dde4215d8ddae7cbc3855bcac713043802edd0519fa90af30be8a01ba
ppc64le
librsvg2-2.50.7-3.el9_9.1.ppc64le.rpm SHA-256: 74aa54a599a84e4ec6d79de4ae613f45aa3df0f92199d4652d06b143d16d03b0
librsvg2-debuginfo-2.50.7-3.el9_9.1.ppc64le.rpm SHA-256: 67355e6cda3fc0e827e6a8a126fe3124dc06e7794ab727fc737e1c5b8d898c72
librsvg2-debugsource-2.50.7-3.el9_9.1.ppc64le.rpm SHA-256: 5689b1589f8d045eaab295b8ce0a1b510672e6bf95f946ced2b012dca144802e
librsvg2-devel-2.50.7-3.el9_9.1.ppc64le.rpm SHA-256: dce0704786ed8ead941fa90c4245e9c255dd3a4daec1360581b3ec6e9aa79044
librsvg2-tools-2.50.7-3.el9_9.1.ppc64le.rpm SHA-256: c7de2f4d8247c48b310fb56c27631cb84a9c1297a92fa70efd8dd3ba08a7cb75
librsvg2-tools-debuginfo-2.50.7-3.el9_9.1.ppc64le.rpm SHA-256: 7d06f36c6fde02c8e45944b1dc4ec51b1d2110009a436a2ba7b34a4760d52c3f

Red Hat Enterprise Linux for ARM 64 9

SRPM
librsvg2-2.50.7-3.el9_9.1.src.rpm SHA-256: 38c3bb5dde4215d8ddae7cbc3855bcac713043802edd0519fa90af30be8a01ba
aarch64
librsvg2-2.50.7-3.el9_9.1.aarch64.rpm SHA-256: 0e0cbf29eb8de26a1c67d08dd3abc2b2be387d8166085fd4ac1419e5847e7a7b
librsvg2-debuginfo-2.50.7-3.el9_9.1.aarch64.rpm SHA-256: b6b00fba5c4135d5b04b31f0f4805d589e2f5253b4d67e1f56bbfd7e678193c3
librsvg2-debugsource-2.50.7-3.el9_9.1.aarch64.rpm SHA-256: 7e8aeed780324ff2a5ae63c579f7266edc041de5511676159cdfc166043d0769
librsvg2-devel-2.50.7-3.el9_9.1.aarch64.rpm SHA-256: 92bd6d031647faac8d0f59e57c0ba6c8f9763070758bc60ad5b436512ca7803a
librsvg2-tools-2.50.7-3.el9_9.1.aarch64.rpm SHA-256: 8191b54e152104eddffd41b9d84f38e3935995c8cc686c7bc54d3de1f71433a5
librsvg2-tools-debuginfo-2.50.7-3.el9_9.1.aarch64.rpm SHA-256: 7ad4ff1dd17e1bd7b641d77fe0d876c6b0d2a2649252747ec74e523ab8708e45

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.