{
  "document" : {
    "aggregate_severity" : {
      "namespace" : "https://access.redhat.com/security/updates/classification/",
      "text" : "Important"
    },
    "category" : "csaf_security_advisory",
    "csaf_version" : "2.0",
    "distribution" : {
      "text" : "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "en",
    "notes" : [ {
      "category" : "summary",
      "text" : "An update for Red Hat Hardened Images RPMs is now available.",
      "title" : "Topic"
    }, {
      "category" : "general",
      "text" : "This update includes the following RPMs:\n\ntempo2.10:\n  * tempo2.10-2.10.9-0.2.hum1 (aarch64, x86_64)\n  * tempo2.10-2.10.9-0.2.hum1.src (src)\n\nSecurity Fix(es):\n\ntempo2.10:\n  * CVE-2026-116591",
      "title" : "Details"
    }, {
      "category" : "legal_disclaimer",
      "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
      "title" : "Terms of Use"
    } ],
    "publisher" : {
      "category" : "vendor",
      "contact_details" : "https://access.redhat.com/security/team/contact/",
      "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name" : "Red Hat Product Security",
      "namespace" : "https://www.redhat.com"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "https://access.redhat.com/errata/RHSA-2026:95406",
      "url" : "https://access.redhat.com/errata/RHSA-2026:95406"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/cve/CVE-2026-116591",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-116591"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/updates/classification/",
      "url" : "https://access.redhat.com/security/updates/classification/"
    }, {
      "category" : "external",
      "summary" : "https://images.redhat.com/",
      "url" : "https://images.redhat.com/"
    }, {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95406.json"
    } ],
    "title" : "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking" : {
      "current_release_date" : "2026-11-10T10:46:10+00:00",
      "generator" : {
        "date" : "2026-11-10T10:46:10+00:00",
        "engine" : {
          "name" : "Red Hat SDEngine",
          "version" : "5.4.5"
        }
      },
      "id" : "RHSA-2026:95406",
      "initial_release_date" : "2026-11-05T03:07:49+00:00",
      "revision_history" : [ {
        "date" : "2026-11-05T03:07:49+00:00",
        "number" : "1",
        "summary" : "Initial version"
      }, {
        "date" : "2026-11-05T03:10:40+00:00",
        "number" : "2",
        "summary" : "Last updated version"
      }, {
        "date" : "2026-11-10T10:46:10+00:00",
        "number" : "3",
        "summary" : "Last generated version"
      } ],
      "status" : "final",
      "version" : "3"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Red Hat Hardened Images",
          "product" : {
            "name" : "Red Hat Hardened Images",
            "product_id" : "Red Hat Hardened Images",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:redhat:hummingbird:1"
            }
          }
        } ],
        "category" : "product_family",
        "name" : "Red Hat Hardened Images"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "tempo2.10-0:2.10.9-0.2.hum1@aarch64",
          "product" : {
            "name" : "tempo2.10-0:2.10.9-0.2.hum1@aarch64",
            "product_id" : "tempo2.10-0:2.10.9-0.2.hum1@aarch64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/tempo2.10@2.10.9-0.2.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "aarch64"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "tempo2.10-0:2.10.9-0.2.hum1@src",
          "product" : {
            "name" : "tempo2.10-0:2.10.9-0.2.hum1@src",
            "product_id" : "tempo2.10-0:2.10.9-0.2.hum1@src",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/tempo2.10@2.10.9-0.2.hum1?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "src"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "tempo2.10-0:2.10.9-0.2.hum1@x86_64",
          "product" : {
            "name" : "tempo2.10-0:2.10.9-0.2.hum1@x86_64",
            "product_id" : "tempo2.10-0:2.10.9-0.2.hum1@x86_64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/tempo2.10@2.10.9-0.2.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "x86_64"
      } ],
      "category" : "vendor",
      "name" : "Red Hat"
    } ],
    "relationships" : [ {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "tempo2.10-0:2.10.9-0.2.hum1@aarch64 as a component of Red Hat Hardened Images",
        "product_id" : "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@aarch64"
      },
      "product_reference" : "tempo2.10-0:2.10.9-0.2.hum1@aarch64",
      "relates_to_product_reference" : "Red Hat Hardened Images"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "tempo2.10-0:2.10.9-0.2.hum1@src as a component of Red Hat Hardened Images",
        "product_id" : "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@src"
      },
      "product_reference" : "tempo2.10-0:2.10.9-0.2.hum1@src",
      "relates_to_product_reference" : "Red Hat Hardened Images"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "tempo2.10-0:2.10.9-0.2.hum1@x86_64 as a component of Red Hat Hardened Images",
        "product_id" : "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@x86_64"
      },
      "product_reference" : "tempo2.10-0:2.10.9-0.2.hum1@x86_64",
      "relates_to_product_reference" : "Red Hat Hardened Images"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2026-116591",
    "cwe" : {
      "id" : "CWE-125",
      "name" : "Out-of-bounds Read"
    },
    "discovery_date" : "2026-10-26T22:34:28.681138+00:00",
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2561461"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard (zstd) compressed stream to an application using the library, resulting in a Denial of Service (DoS). Due to an integer handling error in the decompression logic, the decoder retains stale internal state and performs an out-of-bounds read, triggering an unhandled panic that crashes the application.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "A flaw was found in the klauspost compress library's Zstandard (zstd) decompression implementation. An integer handling flaw in the FSE normalized count parsing logic allows a remote attacker to supply a specially crafted two-block compressed stream. When processed by vulnerable decode routines, the parser retains stale decode-table state and executes an out-of-bounds read, triggering an unhandled runtime panic. Applications decompressing untrusted inputs will terminate abruptly, causing a denial of service, while container boundaries and non-root execution isolate the impact from the underlying host.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@aarch64", "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@src", "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@x86_64" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-116591"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2561461",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2561461"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-116591",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-116591"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-116591",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-116591"
    }, {
      "category" : "external",
      "summary" : "https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d",
      "url" : "https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d"
    }, {
      "category" : "external",
      "summary" : "https://github.com/klauspost/compress/releases/tag/v1.20.2",
      "url" : "https://github.com/klauspost/compress/releases/tag/v1.20.2"
    }, {
      "category" : "external",
      "summary" : "https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8",
      "url" : "https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8"
    } ],
    "release_date" : "2026-10-26T21:54:33.109000+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-11-05T03:07:49+00:00",
      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
      "product_ids" : [ "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@aarch64", "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@src", "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@x86_64" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:95406"
    }, {
      "category" : "workaround",
      "details" : "Reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. No direct configuration-level workaround exists within the library itself.\n\n--- CME Mitigation Guidance (2026-11-03) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce bounds on parsed count values and decode-table indices in klauspost/compress zstd decompression routines to prevent integer wraparound and out-of-bounds indexing: upgrade to klauspost/compress 1.20.2+ (or the corresponding fixed Red Hat builds), which reject counts exceeding math.MaxInt16 in readNCount, restrict Huffman-weight FSE tableLog values to 6 in huff0.ReadTable, and adjust count validation in validateNorm, closing crafted two-block zstd compressed stream. Until patched, this is a concern on applications decompressing untrusted Zstandard (zstd) input using klauspost/compress DecodeAll or streaming decoder, so reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wraparound defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)",
      "product_ids" : [ "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@aarch64", "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@src", "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@x86_64" ]
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "LOW",
        "attackVector" : "NETWORK",
        "availabilityImpact" : "HIGH",
        "baseScore" : 7.5,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "NONE",
        "integrityImpact" : "NONE",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "NONE",
        "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "version" : "3.1"
      },
      "products" : [ "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@aarch64", "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@src", "Red Hat Hardened Images:tempo2.10-0:2.10.9-0.2.hum1@x86_64" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input"
  } ]
}