RHSA-2026:95652: Critical: Satellite 6.19 security update

Q: Which systems should be prioritized for this update?

Red Hat Satellite and Red Hat Satellite Capsule deployments using the affected openvox-agent or openvox-server packages should be prioritized.

Q: Does the reported remote code execution issue require authentication?

Yes. The openvox-server remote code execution vulnerability is described as authenticated and is triggered through report event deserialization.

Q: What other attack impacts are addressed by this update?

The fixes include integer-overflow and double-free flaws involving specially crafted regular expressions in openvox-agent, a certificate-name authorization bypass in openvox-server, and a denial-of-service condition caused by unbounded memory allocation in an asynchronous parser.

Published Nov 5, 2026

Updated

Critical: Satellite 6.19 security update

Other sources

This advisory provides security fixes for affected packages used by Red HatSatellite. The updates address the vulnerabilities described below.Security Fix(es): openvox-agent: Integer overflow when compiling a specially crafted regular expression (CVE-2026-110264). openvox-agent: Integer overflow when compiling a specially crafted CI/CD regular expression (CVE-2026-97229). openvox-agent: Integer overflow when compiling a specially crafted regular expression (CVE-2026-93577). openvox-agent: Double free when parsing a specially crafted regular expression (CVE-2026-89078). openvox-server: Authenticated remote code execution via report event deserialization (CVE-2026-115731). openvox-server: Certificate name authorization bypass via flawed hostname ACL matching (CVE-2026-115732). openvox-server: Denial of Service via unbounded memory allocation in asynchronous parser (CVE-2026-104895).

— Red Hat

Affected Software

4 affected componentsFixes available

Red Hat Red Hat Satellite

Red Hat Red Hat Satellite Capsule

redhat/openvox-agent<8.32.0-1.el9

8.32.0-1.el9

redhat/openvox-server<8.18.0-1.el9

8.18.0-1.el9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/openvox-agent to a version that resolves this vulnerability.
Fixed in 8.32.0-1.el9
Upgrade
Upgrade redhat/openvox-server to a version that resolves this vulnerability.
Fixed in 8.18.0-1.el9

Event History

Nov 5, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·07:36 PM

Data Sourced

via Red Hat·07:36 PM

Severity

Frequently Asked Questions

Which systems should be prioritized for this update?

Red Hat Satellite and Red Hat Satellite Capsule deployments using the affected openvox-agent or openvox-server packages should be prioritized.

Does the reported remote code execution issue require authentication?

Yes. The openvox-server remote code execution vulnerability is described as authenticated and is triggered through report event deserialization.

What other attack impacts are addressed by this update?

The fixes include integer-overflow and double-free flaws involving specially crafted regular expressions in openvox-agent, a certificate-name authorization bypass in openvox-server, and a denial-of-service condition caused by unbounded memory allocation in an asynchronous parser.

RHSA-2026:95652: Critical: Satellite 6.19 security update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems should be prioritized for this update?

Does the reported remote code execution issue require authentication?

What other attack impacts are addressed by this update?

Company

Resources

Contact

Frequently Asked Questions

Which systems should be prioritized for this update?

Does the reported remote code execution issue require authentication?

What other attack impacts are addressed by this update?