RHSA-2026:68775
Vulnerability from csaf_redhat - Published: 2026-09-17 20:52 - Updated: 2026-09-21 11:27Summary
Red Hat Security Advisory: General availability of the satellite/iop-insights-engine-rhel9 container image
Severity
Important
Notes
Topic: A new satellite/iop-insights-engine-rhel9 container image is now generally available in the Red Hat container registry.
Details: Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before the entire body is received. This leaves trailing data to be processed incorrectly, potentially enabling an attacker to bypass security mechanisms or gain unauthorized access to resources.
7.0 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit this to trigger a Denial of Service (DoS) in the client application, making it unavailable.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-69243
Threats
Impact
Important
References
25 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new satellite/iop-insights-engine-rhel9 container image is now generally available in the Red Hat container registry.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services. ",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:68775",
"url": "https://access.redhat.com/errata/RHSA-2026:68775"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69243",
"url": "https://access.redhat.com/security/cve/CVE-2026-69243"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-69244",
"url": "https://access.redhat.com/security/cve/CVE-2026-69244"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://catalog.redhat.com/software/containers/search",
"url": "https://catalog.redhat.com/software/containers/search"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68775.json"
}
],
"title": "Red Hat Security Advisory: General availability of the satellite/iop-insights-engine-rhel9 container image",
"tracking": {
"current_release_date": "2026-09-21T11:27:07+00:00",
"generator": {
"date": "2026-09-21T11:27:07+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:68775",
"initial_release_date": "2026-09-17T20:52:52+00:00",
"revision_history": [
{
"date": "2026-09-17T20:52:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-17T20:52:53+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-21T11:27:07+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.19",
"product": {
"name": "Red Hat Satellite 6.19",
"product_id": "Red Hat Satellite 6.19",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.19::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64",
"product": {
"name": "registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64",
"product_id": "registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/iop-insights-engine-rhel9@sha256%3Af4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-insights-engine-rhel9\u0026tag=1789273626"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64 as a component of Red Hat Satellite 6.19",
"product_id": "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64"
},
"product_reference": "registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64",
"relates_to_product_reference": "Red Hat Satellite 6.19"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-69243",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-08-03T22:02:56.444781+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510831"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before the entire body is received. This leaves trailing data to be processed incorrectly, potentially enabling an attacker to bypass security mechanisms or gain unauthorized access to resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact. This vulnerability in aiohttp\u0027s HTTP parser enables request smuggling when the server-side component handles WebSocket upgrade requests containing a body. An attacker could exploit an edge case during protocol switching, causing trailing data to be processed as subsequent requests or upgraded protocol data. This affects Red Hat products utilizing aiohttp in a server-side capacity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69243"
},
{
"category": "external",
"summary": "RHBZ#2510831",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510831"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69243"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98",
"url": "https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/pull/13017",
"url": "https://github.com/aio-libs/aiohttp/pull/13017"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2",
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v"
}
],
"release_date": "2026-08-03T20:45:43.406000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:52:52+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68775"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade"
},
{
"cve": "CVE-2026-69244",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-08-03T22:02:32.583060+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510825"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit this to trigger a Denial of Service (DoS) in the client application, making it unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important severity flaw in aiohttp that could lead to a denial of service in client applications. A remote, malicious HTTP server could send a specially crafted response, causing an out-of-bounds read in the aiohttp C response parser and resulting in the client application terminating unexpectedly.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-69244"
},
{
"category": "external",
"summary": "RHBZ#2510825",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510825"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-69244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-69244"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69244",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69244"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d",
"url": "https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/pull/13223",
"url": "https://github.com/aio-libs/aiohttp/pull/13223"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3",
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273"
}
],
"release_date": "2026-08-03T20:50:59.538000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T20:52:52+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68775"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-insights-engine-rhel9@sha256:f4e63f9ab72ffacc5fbb4483d8f8be8f5d87bcbb8ae5f4a479d266a3f6f188cd_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…