Red Hat Product Errata RHSA-2026:50263 - Security Advisory Issued: 2026-08-04 Updated: 2026-08-04 RHSA-2026:50263 - Security Advisory Overview Updated Packages Synopsis Important: Satellite 6.18.8 Async Update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic A new release is now available for Red Hat Satellite 6.18 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix(es): puppetserver: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332) python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515) rubygem-faraday-rack: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) python3.12-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) python3.12-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) python3.12-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059) python3.12-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236) puppet-agent: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) Bug Fix(es): Backport OpenVox Server and Agent Packaging to Satellite and Capsule 6.18 (SAT-44866) Update of scap-security-guide-satellite package sources (SAT-48160) API endpoint GET /api/host_packages/installed_packages in apidoc is wrong (SAT-48161) Unable to save bookmark report under Hosts → All Hosts → Compliance → Reports (SAT-48162) 'Katello::Errors::Pulp3Error: nextval: reached maximum value of sequence "container_blobmanifest_id_seq"' during container image sync (SAT-48302) Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Satellite 6.18 x86_64 Red Hat Satellite Capsule 6.18 x86_64 Red Hat Enterprise Linux for x86_64 9 x86_64 Fixes BZ - 2396054 - CVE-2025-9230 openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap BZ - 2458187 - CVE-2026-2332 org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing BZ - 2482734 - CVE-2026-48526 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens BZ - 2489812 - CVE-2026-12515 katello: missing repository authorization in content_uploads exposes cross-product content existence BZ - 2492252 - CVE-2026-54297 faraday: Faraday: Denial of Service via crafted nested query strings BZ - 2492952 - CVE-2026-57236 nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling BZ - 2497452 - CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file BZ - 2497455 - CVE-2026-55380 python-pillow: Pillow: Denial of Service via crafted GD 2.x image file BZ - 2497464 - CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data BZ - 2497466 - CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files SAT-48160 - Update of scap-security-guide-satellite package sources [rhn_satellite_6.18] SAT-48161 - API endpoint GET /api/host_packages/installed_packages in apidoc is wrong [rhn_satellite_6.18] SAT-48162 - Unable to save bookmark report under Hosts ? All Hosts ? Compliance ? Reports [satellite_6.18] SAT-48302 - 'Katello::Errors::Pulp3Error: nextval: reached maximum value of sequence "container_blobmanifest_id_seq"' during container image sync [satellite_6.18] CVEs CVE-2025-9230 CVE-2026-2332 CVE-2026-12515 CVE-2026-48526 CVE-2026-54059 CVE-2026-54060 CVE-2026-54297 CVE-2026-55379 CVE-2026-55380 CVE-2026-57236 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Satellite 6.18 SRPM foreman-installer-3.16.0.9-1.el9sat.src.rpm SHA-256: 0fd35eb8c769dd8ea289c84a071fb0aedc4d47308d93cc4aa95da067917d1542 openvox-agent-8.24.1-3.el9sat.src.rpm SHA-256: f2be77937a849612488c606cc9433f75b8656f276bfe430afb41de39c695cfa9 openvox-server-8.14.1-1.el9sat.src.rpm SHA-256: a78d21484629a731d6b66eaca9fb0c7c8a5a489860b3967a42f1b016a727a1a8 pulpcore-obsolete-packages-1.3.1-3.el9pc.src.rpm SHA-256: 4f753ef327d7041a65fc0c6eb7967a3505dc9beebce892e0c23c0cd3c673d8b8 python3.12-pillow-12.3.0-1.el9pc.src.rpm SHA-256: 51287d8d2ec4216503ea992c2758fa5e7a7295910c3410f46cee258002311574 python3.12-pulp-container-2.24.12-1.el9pc.src.rpm SHA-256: 69ccf3d9c8f32bcf7e3f02a7af079bc170dc042f13495b97972e2eb0caafa6bf python3.12-pyjwt-2.13.0-1.el9pc.src.rpm SHA-256: 723e478e30a9bcf1f560a6da5861de169d0a66bbd158ce18a4da45d9037565d8 python3.12-pysequoia-0.1.33-1.el9pc.src.rpm SHA-256: 76e235f957aaf9a1d9e6d93de5bd09107cd0bcd4d69c0888a51a7a4fe0d4a7d6 rubygem-faraday-1.10.6-1.el9sat.src.rpm SHA-256: 74f638434ff19a9e703f2792f3cb8bc1fc2dc467aecbfd97a7dd648505d03b9f rubygem-foreman_maintain-1.13.10-1.el9sat.src.rpm SHA-256: 8254d219a191e5ba986ee5c4f27266a04edaace9ea3d951d3f35cb85bf4a1336 rubygem-foreman_openscap-11.1.2-1.el9sat.src.rpm SHA-256: 7a10149cc87074cce9007efc0994205b20dfe322f59c30bf28e694cb42bf2939 rubygem-katello-4.18.0.15-1.el9sat.src.rpm SHA-256: 74f1dc11ee3954aa88188ae439f2a0c384b0c1f886339c9ccfd9bf467a80f138 rubygem-nokogiri-1.15.7-3.el9sat.src.rpm SHA-256: eb84e56282b26a78e6875d5187445e01302153082e651af00836f80902a64ad0 satellite-6.18.8-1.el9sat.src.rpm SHA-256: aa95206b51ca6b34d254cc3148eb053fbcf408c9c62c3926033059d3a04a4a7c scap-security-guide-satellite-1.0.6-1.el9sat.src.rpm SHA-256: 4c29d812196f98389c918673184a5cefe8308aa2dcdfd00333b8e394b6bc68c5 x86_64 foreman-installer-3.16.0.9-1.el9sat.noarch.rpm SHA-256: ff152413d8f1ca1aaf9885755b618fa5dc51e90c0eaa7fd6698d3025ef164aab foreman-installer-katello-3.16.0.9-1.el9sat.noarch.rpm SHA-256: 2e384ef6887bc6cc180b37e7068e7e52e9c89b716df662c5123e6fc7ef77a493 openvox-agent-8.24.1-3.el9sat.x86_64.rpm SHA-256: 0877931b6cfd178af8f547fdbf4f1efd756ed17bcb524408d2389e02dce2ea57 openvox-server-8.14.1-1.el9sat.noarch.rpm SHA-256: 04acd810d2fd8ade1afabecc237f1b77b72d21f933a987ced727aebb77332169 pulpcore-obsolete-packages-1.3.1-3.el9pc.noarch.rpm SHA-256: 2323cb7672aa2843a5ab6ca85be3ded7c5f0d375a21eb90d7a03eba4735f6d36 python3.12-pillow-12.3.0-1.el9pc.x86_64.rpm SHA-256: add91eb682ee7b87fbdeb4a918c9cceae4f08f4e8dd64669e54eaca9837dc0c6 python3.12-pillow-debuginfo-12.3.0-1.el9pc.x86_64.rpm SHA-256: 56a4b6ace5594372e84e986d665bb0a9728f9483ba3e14eb3507165e3339186c python3.12-pillow-debugsource-12.3.0-1.el9pc.x86_64.rpm SHA-256: 47f508bc7f0a940e7425e19c60610caa76950b702ab2ad67603626b1f0e50665 python3.12-pulp-container-2.24.12-1.el9pc.noarch.rpm SHA-256: b363e45d21fa0bbe61e58aba919de38ffda17bcc7e66ea6d26f443a61a3c66b8 python3.12-pyjwt+crypto-2.13.0-1.el9pc.noarch.rpm SHA-256: 5727c80ea52f6fd623cf0369f99fd505fd1115aa86e2dd3cb33706f86252b123 python3.12-pyjwt-2.13.0-1.el9pc.noarch.rpm SHA-256: e3967bc581b586585fddd35c2bb17f7d8ceed65d31f1ea2eeaca4d6c5117e044 python3.12-pysequoia-0.1.33-1.el9pc.x86_64.rpm SHA-256: d74fd5cd967756eea1ae66755e4515938e50df3fb72a535ef8ed5b89676df8bf rubygem-faraday-1.10.6-1.el9sat.noarch.rpm SHA-256: f4668f31aa21b758c5d9594c5b514906ed3a1b26b816f83d78c5b7ae6e48f1bf rubygem-foreman_maintain-1.13.10-1.el9sat.noarch.rpm SHA-256: ad2f9c71d624a97c582ecef3eaa5c837a5f828df7a87443cfdeb5273c4df2ac0 rubygem-foreman_openscap-11.1.2-1.el9sat.noarch.rpm SHA-256: d97701b20f9db6a96ec33f9bf4363fd618300e83606abbf3eec3bd4eacaf3022 rubygem-katello-4.18.0.15-1.el9sat.noarch.rpm SHA-256: 44f189f29f355f655fe21d2b4f9033f83daf6f013eacbe0b32dbce6cb4b690ac rubygem-nokogiri-1.15.7-3.el9sat.x86_64.rpm SHA-256: fcc2f7cdd663b5f8c277bc06dcdab753a0c9de2ae73e34b6eaa7d01d29c473fe rubygem-nokogiri-debuginfo-1.15.7-3.el9sat.x86_64.rpm SHA-256: 49481bb021bb91666541f55e918c2723f8a9e4f9c1caea77a9f69e2251a56862 rubygem-nokogiri-debugsource-1.15.7-3.el9sat.x86_64.rpm SHA-256: 8c73032291556dd6d6828a3c45fead29db0ce571b83c14270a1e397af594c741 satellite-6.18.8-1.el9sat.noarch.rpm SHA-256: 05a032e11832928fe9cb88736f55a4e766043ebb12bb9f0832b2429d6914e7e9 satellite-cli-6.18.8-1.el9sat.noarch.rpm SHA-256: 96067c130c61b931ea8f17ccccc14d345253dd6e99499ee0606a2cb1d402dc2c satellite-common-6.18.8-1.el9sat.noarch.rpm SHA-256: dbf1e7e1eeab301b92f825250c94f509e7207352dde9dac6b0af45cc073c46eb satellite-obsolete-packages-6.18.8-1.el9sat.noarch.rpm SHA-256: e8247bdc774fa0e269e284e3dfa971c1267e7046e9ebabc9933cc2a4b01603d6 scap-security-guide-satellite-1.0.6-1.el9sat.noarch.rpm SHA-256: af0de4d108486768dc8bc6a63a0845de7ca8c9542eb13d6876afd1bae3bc843d Red Hat Satellite Capsule 6.18 SRPM foreman-installer-3.16.0.9-1.el9sat.src.rpm SHA-256: 0fd35eb8c769dd8ea289c84a071fb0aedc4d47308d93cc4aa95da067917d1542 openvox-agent-8.24.1-3.el9sat.src.rpm SHA-256: f2be77937a849612488c606cc9433f75b8656f276bfe430afb41de39c695cfa9 openvox-server-8.14.1-1.el9sat.src.rpm SHA-256: a78d21484629a731d6b66eaca9fb0c7c8a5a489860b3967a42f1b016a727a1a8 pulpcore-obsolete-packages-1.3.1-3.el9pc.src.rpm SHA-256: 4f753ef327d7041a65fc0c6eb79