Loading story…
Red Hat released Important libarchive security updates for affected RHEL 7 ELS, RHEL 8, and RHEL 9 releases and subscription channels, including OpenShift Container Platform and RHEL-based middleware containers. The updates remediate CVE-2026-4424, a heap out-of-bounds read in RAR processing: a crafted archive can exploit an LZSS dictionary-size validation error after PPMd-to-LZSS transitions to expose heap memory through archive_read_data() before CRC validation. Systems that automatically process untrusted archives may be remotely triggerable without authentication or user interaction.
The releases also fix CVE-2026-5121, an ISO9660 zisofs parsing integer overflow that can allocate an undersized buffer and copy attacker-controlled data beyond its bounds. The resulting heap overflow can potentially enable arbitrary code execution on 32-bit targets, subject to allocator- and platform-specific heap grooming; 64-bit systems do not exhibit the same integer wraparound. Organizations should update libarchive and associated bsdtar, bsdcat, and bsdcpio packages using the applicable Red Hat advisory—for example, RHEL 9 packages 3.5.3-9.el9_7, RHEL 8 packages 3.3.3-7.el8_10, and RHEL 7 ELS packages 3.1.2-14.el7_9.2—or later supported versions.
See affected versions and whether adversaries are exploiting it.
11 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2026:9592 for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On. It provided libarchive 3.3.3-1.el8_4.2 packages for x86_64 to remediate CVE-2026-4424 and CVE-2026-5121.
Red Hat issued Important advisory RHSA-2026:8866 for RHEL 9.6 lifecycle and update-service offerings. The libarchive 3.5.3-7.el9_6.1 packages remediate CVE-2026-4424 and CVE-2026-5121 on x86_64, aarch64, ppc64le, and s390x.
Red Hat issued Important advisory RHSA-2026:8873 for RHEL 9.4 servicing channels, including EUS, AUS, SAP, four-year-update, and Extended Life Cycle. It supplied libarchive 3.5.3-5.el9_4 and related packages that fix CVE-2026-4424 and CVE-2026-5121.
Red Hat issued Important advisory RHSA-2026:8864 for RHEL 9.2 SAP, AUS, four-year-update, and Extended Life Cycle channels. The advisory supplied fixed libarchive 3.5.3-5.el9_2.2 packages for CVE-2026-4424 and CVE-2026-5121.
Red Hat issued Important advisory RHSA-2026:8867 for RHEL 9.0 Update Services for SAP Solutions. It provided libarchive 3.5.3-2.el9_0.4 for ppc64le, x86_64, aarch64, and s390x systems to address CVE-2026-4424 and CVE-2026-5121.
Red Hat issued Important advisory RHSA-2026:9026 for RHEL 8.8 Extended Life Cycle Long Life, Telecommunications Update Service, and SAP Solutions offerings. The libarchive 3.3.3-5.el8_8.2 update remediates CVE-2026-4424 and CVE-2026-5121.
Red Hat issued Important advisory RHSA-2026:8908 for RHEL 8.6 AMCS, AUS, TUS, SAP Solutions, and long-life channels. It supplied libarchive 3.3.3-6.el8_6.1 packages for x86_64 and ppc64le to fix CVE-2026-4424 and CVE-2026-5121.
Red Hat issued Important advisory RHSA-2026:8510 for RHEL 9, providing libarchive 3.5.3-9.el9_7 and associated utilities. The update remediates CVE-2026-4424 and CVE-2026-5121 for x86_64, s390x, ppc64le, and aarch64 offerings.
Red Hat issued Important advisory RHSA-2026:8534 for RHEL 8 and RHEL 8.10 Extended Life Cycle, supplying libarchive 3.3.3-7.el8_10. The update remediates CVE-2026-4424 and CVE-2026-5121 across x86_64, aarch64, ppc64le, and s390x platforms.
Red Hat issued Important advisory RHSA-2026:8521 for RHEL Server AUS 8.2 on x86_64, providing libarchive 3.3.2-8.el8_2.2. It fixes the RAR out-of-bounds-read flaw CVE-2026-4424 and ISO9660 integer-overflow flaw CVE-2026-5121.
Red Hat issued Important advisory RHSA-2026:8517 for RHEL 7 Extended Lifecycle Support, supplying libarchive 3.1.2-14.el7_9.2. The update remediates CVE-2026-4424 information disclosure and CVE-2026-5121 potential arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
13 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released security updates for **CVE-2026-14164**, a Moderate-severity double-free flaw in `libarchive`'s RAR5 decompression logic. The bug stems from a dangling `filtered_buf` pointer in `init_unpack()` within `archive_read_support_format_rar5.c`, allowing a specially crafted RAR5 archive to trigger a second free of the same memory. Red Hat said the issue can crash affected applications and cause **denial of service**, with impact centered on availability rather than confidentiality or integrity. The vendor published multiple advisories covering **RHEL 9** support streams, including **RHSA-2026:58558** for RHEL 9.6, **RHSA-2026:58573** for RHEL 9.4 channels, and **RHSA-2026:58574** for RHEL 9.2 SAP and lifecycle variants, with updated `libarchive` packages released across `x86_64`, `aarch64`, `ppc64le`, and `s390x`. Red Hat's bug tracking also said fixes extend to other products, including **RHEL 10** and **OpenShift Container Platform 4.22**. Tenable published a Nessus detection plugin for exposed RHEL 9 systems and noted that, at publication, no known exploits were available.
Aug 24, 2026
Red Hat released **Important** security updates for Go packages across **Red Hat Enterprise Linux 8, 9, and 10** to fix multiple vulnerabilities, led by `CVE-2025-61728`, a denial-of-service flaw in Go's `archive/zip` component. The bug stems from a super-linear file-name indexing algorithm that runs when a file in a ZIP archive is first opened, allowing a crafted archive to trigger excessive CPU consumption and make affected applications unavailable. Red Hat said the issue was addressed broadly across standard, Extended Update Support, SAP, AUS/TUS, and Extended Life Cycle channels, as well as products including **Cryostat 4 on RHEL 9** and multiple **OpenShift Container Platform** versions. The advisories also remediate `CVE-2025-61726` in `net/url`, which can cause memory exhaustion during query parsing, `CVE-2025-61732` in `cmd/cgo`, which could enable code smuggling through doc comments, and in several RHEL 9.6, 10.0, and 10.1 channels `CVE-2025-68121` in `crypto/tls`, involving unexpected session resumption. Updated packages include Go builds such as **`golang 1.25.7`** for newer RHEL 9 and 10 releases, alongside backported fixes in older supported streams including RHEL 8.6 and 8.8 toolsets and RHEL 9.0, 9.2, and 9.4 channels.
Aug 20, 2026
Red Hat released **Important** security updates for Node.js packages across **RHEL 8, 9, and 10** to fix three denial-of-service vulnerabilities in bundled components: `CVE-2026-13149` in **brace-expansion**, `CVE-2026-59873` in **node-tar**, and `CVE-2026-59874` in **node-tar/tar**. The advisories cover multiple product streams, including `nodejs:24` on RHEL 8 and 9, `nodejs22` and `nodejs24` on RHEL 10, and `nodejs:22` for RHEL 9.6 Extended Update Support, with updated packages such as Node.js 22.23.1 and 24.18.0 distributed across standard, EUS, and ELC channels. The flaws could let attackers trigger excessive resource consumption through crafted input during archive handling or pattern expansion. In **brace-expansion**, consecutive non-expanding `{}` groups can drive exponential-time processing and block the event loop; in **node-tar**, a crafted gzip bomb can exhaust CPU and disk during extraction or parsing, while a malformed tar header with a negative base-256 entry size can cause the scanner to repeatedly parse the same header without making progress. Red Hat tracked the issues in Bugzilla and published remediation through advisories including `RHSA-2026:47060`, `RHSA-2026:47057`, `RHSA-2026:48033`, `RHSA-2026:48034`, `RHSA-2026:52399`, and `RHSA-2026:53298`.
Aug 23, 2026