{"id":"RHSA-2026:80677","summary":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","modified":"2026-10-20T10:43:07.826828582Z","published":"2026-10-14T10:32:10Z","related":["GO-2024-2611"],"upstream":["CVE-2024-24786","CVE-2026-109574","CVE-2026-109595","CVE-2026-109596","CVE-2026-109597"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:80677"},{"type":"ARTICLE","url":"https://images.redhat.com/"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2024-24786"},{"type":"ARTICLE","url":"https://access.redhat.com/security/updates/classification/"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-109596"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-109595"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-109574"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-109597"},{"type":"ADVISORY","url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80677.json"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268046"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2024-24786"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24786"},{"type":"ARTICLE","url":"https://go.dev/cl/569356"},{"type":"ARTICLE","url":"https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/"},{"type":"ADVISORY","url":"https://pkg.go.dev/vuln/GO-2024-2611"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550039"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-109574"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109574"},{"type":"ARTICLE","url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf"},{"type":"ARTICLE","url":"https://www.vulncheck.com/advisories/hugo-before-0.167.0-path-traversal-via-css-sass-import-fallback"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550056"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-109595"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109595"},{"type":"ARTICLE","url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424"},{"type":"ARTICLE","url":"https://www.vulncheck.com/advisories/hugo-0.84.0-before-0.167.0-path-traversal-via-js-build-esbuild-resolver"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550016"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-109596"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109596"},{"type":"ARTICLE","url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47"},{"type":"ARTICLE","url":"https://www.vulncheck.com/advisories/hugo-from-0.162.0-before-0.167.0-symlink-file-disclosure-via-nested-mount-ancestor"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550088"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-109597"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109597"},{"type":"ARTICLE","url":"https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg"},{"type":"ARTICLE","url":"https://www.vulncheck.com/advisories/hugo-0.60.0-before-0.167.0-stored-xss-via-table-of-contents-heading-ids"}],"affected":[{"package":{"name":"hugo","ecosystem":"Red Hat:hummingbird:1","purl":"pkg:rpm/redhat/hugo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.167.0-0.2.hum1"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:80677.json"}}],"schema_version":"1.9.1","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}