RHSA-2026:59549: Important: ignition security update

Q: Which deployments are most relevant to assess for exposure?

Assess systems that use Ignition during initramfs or first boot and obtain Ignition configuration from a remote URL, network metadata service, or hypervisor bridge. The advisory lists the Ignition packages, including ignition-edge and ignition-validate, as affected software.

Q: What attacker capability is indicated by the available information?

The listed issue is a privilege-escalation vulnerability involving incorrect Punycode label processing in golang.org/x/net/idna and net/http. The advisory data does not specify the required access level, input path, or exploitation conditions.

Q: How can I determine whether an installed package is covered by this update?

Compare installed packages against the software named in the advisory: redhat/ignition, redhat/ignition-debuginfo, redhat/ignition-debugsource, redhat/ignition-edge, redhat/ignition-validate, and redhat/ignition-validate-debuginfo. No fixed package versions are provided in the supplied data.

Published Aug 25, 2026

Updated

Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files (regular files, systemd units, etc.), and configuring users. On first boot, Ignition reads its configuration from a source of truth (remote URL, network metadata service, hypervisor bridge, etc.) and applies the configuration.Security Fix(es): golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

24 affected componentsFixes available

redhat/ignition<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-debuginfo<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-debugsource<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-edge<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-validate<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-validate-debuginfo<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-debuginfo<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-debugsource<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-edge<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-validate<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-validate-debuginfo<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition<2.17.0-2.el9_4.1.aa

2.17.0-2.el9_4.1.aa

redhat/ignition-debuginfo<2.17.0-2.el9_4.1.aa

2.17.0-2.el9_4.1.aa

redhat/ignition-debugsource<2.17.0-2.el9_4.1.aa

2.17.0-2.el9_4.1.aa

redhat/ignition-edge<2.17.0-2.el9_4.1.aa

2.17.0-2.el9_4.1.aa

redhat/ignition-validate<2.17.0-2.el9_4.1.aa

2.17.0-2.el9_4.1.aa

redhat/ignition-validate-debuginfo<2.17.0-2.el9_4.1.aa

2.17.0-2.el9_4.1.aa

redhat/ignition-debuginfo<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-debugsource<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-edge<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-validate<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

redhat/ignition-validate-debuginfo<2.17.0-2.el9_4.1

2.17.0-2.el9_4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/ignition to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1
Upgrade
Upgrade redhat/ignition-debuginfo to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1
Upgrade
Upgrade redhat/ignition-debugsource to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1
Upgrade
Upgrade redhat/ignition-edge to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1
Upgrade
Upgrade redhat/ignition-validate to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1
Upgrade
Upgrade redhat/ignition-validate-debuginfo to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1
Upgrade
Upgrade redhat/ignition to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1.aa
Upgrade
Upgrade redhat/ignition-debuginfo to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1.aa
Upgrade
Upgrade redhat/ignition-debugsource to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1.aa
Upgrade
Upgrade redhat/ignition-edge to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1.aa
Upgrade
Upgrade redhat/ignition-validate to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1.aa
Upgrade
Upgrade redhat/ignition-validate-debuginfo to a version that resolves this vulnerability.
Fixed in 2.17.0-2.el9_4.1.aa

Event History

Aug 25, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

Which deployments are most relevant to assess for exposure?

Assess systems that use Ignition during initramfs or first boot and obtain Ignition configuration from a remote URL, network metadata service, or hypervisor bridge. The advisory lists the Ignition packages, including ignition-edge and ignition-validate, as affected software.

What attacker capability is indicated by the available information?

The listed issue is a privilege-escalation vulnerability involving incorrect Punycode label processing in golang.org/x/net/idna and net/http. The advisory data does not specify the required access level, input path, or exploitation conditions.

How can I determine whether an installed package is covered by this update?

Compare installed packages against the software named in the advisory: redhat/ignition, redhat/ignition-debuginfo, redhat/ignition-debugsource, redhat/ignition-edge, redhat/ignition-validate, and redhat/ignition-validate-debuginfo. No fixed package versions are provided in the supplied data.

RHSA-2026:59549: Important: ignition security update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are most relevant to assess for exposure?

What attacker capability is indicated by the available information?

How can I determine whether an installed package is covered by this update?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most relevant to assess for exposure?

What attacker capability is indicated by the available information?

How can I determine whether an installed package is covered by this update?