{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nopenssl:\n  * openssl-3.5.6-0.5.hum1 (aarch64, x86_64)\n  * openssl-config-fips-3.5.6-0.5.hum1 (aarch64, x86_64)\n  * openssl-devel-3.5.6-0.5.hum1 (aarch64, x86_64)\n  * openssl-devel-engine-3.5.6-0.5.hum1 (aarch64, x86_64)\n  * openssl-fips-provider-upstream-3.5.6-0.5.hum1 (aarch64, x86_64)\n  * openssl-libs-3.5.6-0.5.hum1 (aarch64, x86_64)\n  * openssl-perl-3.5.6-0.5.hum1 (aarch64, x86_64)\n  * openssl-3.5.6-0.5.hum1.src (src)\n\nSecurity Fix(es):\n\nopenssl:\n  * CVE-2026-14456",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:56097",
        "url": "https://access.redhat.com/errata/RHSA-2026:56097"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-14456",
        "url": "https://access.redhat.com/security/cve/CVE-2026-14456"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54876",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54876"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56097.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-29T23:46:55+00:00",
      "generator": {
        "date": "2026-09-29T23:46:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:56097",
      "initial_release_date": "2026-08-18T10:51:22+00:00",
      "revision_history": [
        {
          "date": "2026-08-18T10:51:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-29T23:46:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-0:3.5.6-0.5.hum1@aarch64",
                "product": {
                  "name": "openssl-0:3.5.6-0.5.hum1@aarch64",
                  "product_id": "openssl-0:3.5.6-0.5.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.5.6-0.5.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-0:3.5.6-0.5.hum1@src",
                "product": {
                  "name": "openssl-0:3.5.6-0.5.hum1@src",
                  "product_id": "openssl-0:3.5.6-0.5.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.5.6-0.5.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-0:3.5.6-0.5.hum1@x86_64",
                "product": {
                  "name": "openssl-0:3.5.6-0.5.hum1@x86_64",
                  "product_id": "openssl-0:3.5.6-0.5.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl@3.5.6-0.5.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-0:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@aarch64"
        },
        "product_reference": "openssl-0:3.5.6-0.5.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-0:3.5.6-0.5.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@src"
        },
        "product_reference": "openssl-0:3.5.6-0.5.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-0:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@x86_64"
        },
        "product_reference": "openssl-0:3.5.6-0.5.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-14456",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T14:21:24.109249+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515348"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 9.8+, 10.2+, Red Hat Hardened Images, RHIVOS 2, and OpenShift 4.22 ship OpenSSL 3.5.x which includes the QUIC server implementation affected by this flaw. Earlier RHEL versions ship OpenSSL 3.2.x or below, which do not include the QUIC server feature and are not affected. The FIPS module is not affected as the QUIC implementation is outside the OpenSSL FIPS module boundary. Applications must explicitly enable the QUIC server listener to be vulnerable; simply having OpenSSL 3.5 installed does not expose the flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@aarch64",
          "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@src",
          "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14456"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515348",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515348"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14456",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14456"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
          "url": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
          "url": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
          "url": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260813.txt",
          "url": "https://openssl-library.org/news/secadv/20260813.txt"
        }
      ],
      "release_date": "2026-08-13T13:55:52.370000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T10:51:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@aarch64",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@src",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56097"
        },
        {
          "category": "workaround",
          "details": "Option 1: Rate-limit or Firewall Inbound QUIC (UDP 443) [Goal: Slow or block QUIC Initial packets before they reach the vulnerable listener.]\n\nA. Confirm QUIC Exposure - Check if any service is listening on UDP 443:\n~~~\n$ ss -ulnp | grep \u0027:443\u0027\n# or\n$ sudo lsof -iUDP:443 -n -P\n~~~\n\nNote: If no service is listening on UDP 443, this CVE does not apply (TCP 443 is unaffected).\n\nB. Restrict Access to UDP 443 ( Default-deny UDP 443 and allow only trusted networks:)\n~~~\n$ sudo firewall-cmd --permanent --remove-service=quic 2\u003e/dev/null\n$ sudo firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"10.0.0.0/8\" port port=\"443\" protocol=\"udp\" accept\u0027\n$ sudo firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" port port=\"443\" protocol=\"udp\" drop\u0027\n$ sudo firewall-cmd --reload\n~~~\n\nC. Verify - Confirm the restriction by testing from an external host (the connection should fail or be throttled):\n~~~\n$ nc -u -v YOUR_HOST 443\n~~~\n\nOption 2: Disable QUIC Server\n\nIf QUIC/HTTP3 is not required, remove the vulnerable code path entirely and use TLS/TCP instead.\n\nRecommended Mitigation Priority\nPriority : Action\n1.Confirm UDP 443 QUIC listener exists and OpenSSL version is in affected range\n2.Block or rate-limit UDP 443 at firewall/edge (immediate)\n3.Disable QUIC/HTTP3 on the service if not needed\n4.Upgrade OpenSSL to fixed release when available\n5.Application owners: set SSL_VALUE_QUIC_MAX_PENDING_CONNS if default 256 is too high",
          "product_ids": [
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@aarch64",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@src",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@aarch64",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@src",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server"
    },
    {
      "cve": "CVE-2026-54876",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-08-05T15:21:19.015952+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511600"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A malicious TLS (Transport Layer Security) server can exploit this vulnerability by sending a specially crafted OCSP (Online Certificate Status Protocol) response during the X.509 certificate chain verification process. This can lead to a memory leak in client applications that have enabled OCSP response checking. Repeated connections to a malicious server could exhaust the client\u0027s memory, ultimately resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: openssl-src: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important because a malicious TLS server can cause memory exhaustion and denial of service in a long-running client. Exploitation requires the client application to enable OCSP response checking and process a crafted OCSP response from the server. Exposure therefore depends on the application\u2019s configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@aarch64",
          "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@src",
          "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54876"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511600",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511600"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54876",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54876"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54876",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54876"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/155b5fe0f93365e6df1c56ee3606b121080c6c12",
          "url": "https://github.com/openssl/openssl/commit/155b5fe0f93365e6df1c56ee3606b121080c6c12"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/d8c51048ac037a21bae0f41cad7a3920dc7f3638",
          "url": "https://github.com/openssl/openssl/commit/d8c51048ac037a21bae0f41cad7a3920dc7f3638"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260805.txt",
          "url": "https://openssl-library.org/news/secadv/20260805.txt"
        }
      ],
      "release_date": "2026-08-05T13:59:36.466000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T10:51:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@aarch64",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@src",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56097"
        },
        {
          "category": "workaround",
          "details": "No broadly applicable mitigation is available. If an affected client application provides a configuration setting for OCSP response checking, operators can temporarily disable it where their certificate revocation policy permits. This blocks the vulnerable response-checking path but removes OCSP-based revocation checks. Clients that must keep OCSP response checking enabled remain exposed.",
          "product_ids": [
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@aarch64",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@src",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@aarch64",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@src",
            "Red Hat Hardened Images:openssl-0:3.5.6-0.5.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: openssl-src: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking"
    }
  ]
}