Red Hat rhc Updates Expand Across RHEL 8 and 9
Tech GuruQuick Answer
Red Hat issued four rhc updates for RHEL 8.10, RHEL 9.2 and 9.4 SAP E4S, and RHEL 9.6 EUS. The RHEL 8 advisory addresses one Go text-processing flaw; the three RHEL 9 advisories cover four different Go-library flaws. Match the advisory, package build, and support stream rather than treating all five CVEs as applying to every row.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory the installed rhc client and daemon, match its RHEL release and repository to the appropriate advisory, install that branch's fixed package, and verify its system-management connection to Red Hat services.
Last verified: 2026-09-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 8.10 AppStream, RHEL 9.2/9.4 SAP E4S, and RHEL 9.6 EUS rhc packages |
|---|---|
| Advisory | RHSA-2026:69105 / RHSA-2026:69104 / RHSA-2026:69107 / RHSA-2026:69258 |
| CVEs | CVE-2026-33818, CVE-2026-56852, CVE-2026-56858, CVE-2026-56860, CVE-2026-56862 |
| Authoritative release date | 2026-09-21 03:08:41 UTC |
| Authority revision date | 2026-09-21 11:53:24 UTC |
| Affected versions | The listed rhc packages in the corresponding RHEL AppStream, SAP E4S, or EUS repository before that branch's advisory build. |
| Fixed version | rhc 0.2.5-11.el8_10 / 0.2.2-1.el9_2.5 / 0.2.4-9.el9_4.1 / 0.2.7-1.el9_6.6 |
| CVSS base score | 7.5 / 8.1 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
rhc connects a system to Red Hat's hosted management services. RHSA-2026:69258 for RHEL 8 addresses an infinite loop while normalizing invalid UTF-8 (CVE-2026-56852). The RHEL 9 advisories address excessive ASN.1 recursion (33818), HTML-template injection (56858), costly URL path resolution (56860), and repeated TLS KeyUpdate processing (56862). These are library-level descriptions; they do not by themselves establish that each input path is exposed in a particular deployment.
What To Validate Now
- Inventory. Record rhc's full package identity, RHEL release, enabled repository, system owner, and hosted-management connection.
- Establish applicability. Use RHSA-2026:69258 for RHEL 8.10 AppStream, 69104 for RHEL 9.2 SAP E4S, 69105 for RHEL 9.4 SAP E4S, and 69107 for RHEL 9.6 EUS. These records do not have identical CVE coverage.
- Remediate. Install the corresponding rhc build:
0.2.5-11.el8_10for RHEL 8.10,0.2.2-1.el9_2.5for 9.2 E4S,0.2.4-9.el9_4.1for 9.4 E4S, or0.2.7-1.el9_6.6for 9.6 EUS. Follow that repository's supported package transaction and activation guidance. - Validate. Confirm the installed rhc package, daemon health, and expected system-management connection. Record failed connections or changed management behavior before expanding deployment.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
