RHSA-2026:98584: Important: glycin-loaders security update
Sandboxed and extendable image decoding.Security Fix(es): librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/glycin-loadersto a version that resolves this vulnerability.Fixed in 1.0.1-1.el10_3.2 - Upgrade
Upgrade
redhat/glycin-loaders-debuginfoto a version that resolves this vulnerability.Fixed in 1.0.1-1.el10_3.2 - Upgrade
Upgrade
redhat/glycin-loaders-debugsourceto a version that resolves this vulnerability.Fixed in 1.0.1-1.el10_3.2
Event History
Frequently Asked Questions
Which packages are covered by this security update?
The update covers redhat/glycin-loaders, redhat/glycin-loaders-debuginfo, and redhat/glycin-loaders-debugsource.
What vulnerability is addressed?
The update addresses a use-after-free issue in librsvg when XML includes contain duplicated entities. The issue is identified as CVE-2026-96889 and RUSTSEC-2026-0305.