This Important security update for fence-agents on RHEL 8 addresses three vulnerabilities: a subgroup attack in the cryptography library due to missing validation (CVE-2026-26007, CVSS 6.5), a denial of service via unbounded recursion in pyasn1 (CVE-2026-30922, CVSS 7.5), and PyJWT accepting unknown `crit` header extensions (CVE-2026-32597, CVSS 7.5). Affected versions are cryptography.io cryptography < 46.0.5, pyjwt < 2.12.0, and pyasn1 < 0.6.3. The fixed versions are cryptography 46.0.5, pyjwt 2.12.0, and pyasn1 0.6.3.
Red Hat Product Errata RHSA-2026:12176 - Security Advisory Issued: 2026-04-30 Updated: 2026-04-30 RHSA-2026:12176 - Security Advisory Overview Updated Packages Synopsis Important: fence-agents security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for fence-agents is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007) pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597) pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux High Availability for x86_64 8 x86_64 Red Hat Enterprise Linux High Availability for ARM 64 8 aarch64 Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux Resilient Storage for x86_64 8 x86_64 Red Hat Enterprise Linux Resilient Storage for IBM z Systems 8 s390x Red Hat Enterprise Linux High Availability for IBM z Systems 8 s390x Red Hat Enterprise Linux Resilient Storage for Power, little endian 8 ppc64le Red Hat Enterprise Linux High Availability for Power, little endian 8 ppc64le Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Red Hat Enterprise Linux High Availability for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux High Availability for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux High Availability for IBM z Systems - Extended Life Cycle 8.10 s390x Red Hat Enterprise Linux High Availability for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux Resilient Storage for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux Resilient Storage for IBM z Systems - Extended Life Cycle 8.10 s390x Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Life Cycle 8.10 x86_64 Fixes BZ - 2438762 - CVE-2026-26007 cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves BZ - 2447194 - CVE-2026-32597 pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) BZ - 2448553 - CVE-2026-30922 pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVEs CVE-2026-26007 CVE-2026-30922 CVE-2026-32597 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM fence-agents-4.2.1-129.el8_10.25.src.rpm SHA-256: f1a6061a0884d1c28b841bd9660f6a8ba36a6e3c1e2cf030c58b39767b338a7c x86_64 fence-agents-aliyun-debuginfo-4.2.1-129.el8_10.25.x86_64.rpm SHA-256: e60b5f07b3e3020a1b4f24dc2de33123f18ef807e6302a3b5971b19da8d3c0ce fence-agents-all-4.2.1-129.el8_10.25.x86_64.rpm SHA-256: 5a4ffd3721de9901a1f798e618c1dfeb3409508e32cb01b3c60e69e8415af922 fence-agents-amt-ws-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 2a32574f16ba1eba547116dc0654fe41236932e77b906d2af2377e7122d8b31c fence-agents-apc-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 86cb68f8255dda7b090ff94d72c02ce2dbc8825b2a66301766ff79e9ba5263d4 fence-agents-apc-snmp-4.2.1-129.el8_10.25.noarch.rpm SHA-256: f50432e6c6d82948edd4ad00b04da8ff4b742774883fc401ac0023dfb6de73ce fence-agents-azure-arm-debuginfo-4.2.1-129.el8_10.25.x86_64.rpm SHA-256: 2a0ae03467d654621fd8df19275ce11af44031ad605e7602e5230e2e6b4011d0 fence-agents-bladecenter-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 2db8d50d9540eb0c51fb5c3431fd66c09fa8a258c1c48a7876225df98be472a2 fence-agents-brocade-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 0e7d8335bfb73a3f4e21caccf0dc7d9b0be99e03d191299bc76e87745f283fb9 fence-agents-cisco-mds-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 2dc35cdbf76a0a06ad3267330405a5c835191a495bcdcbe08ef09cc5c02d6a46 fence-agents-cisco-ucs-4.2.1-129.el8_10.25.noarch.rpm SHA-256: adbdd5de4481052c32d7af82f0ed98a008829eb7d2e9199a4cb659f774762a2c fence-agents-common-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 59a157245e33ae1e4095753b9a692a3bdcfd48335d284e5b624815eb88a1b03e fence-agents-compute-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 1def0ac1235e9fb8efc73aed6e398222c31d2aa378e9a264ffb6383a94017c42 fence-agents-debuginfo-4.2.1-129.el8_10.25.x86_64.rpm SHA-256: 4034d16b9a08da384c2bc7a0d8ff59d7d6cc88318f91a6b8efd253ca4aebda55 fence-agents-debugsource-4.2.1-129.el8_10.25.x86_64.rpm SHA-256: befffe40b3c6d703d5ceb9d3e74a47a988f6d41be2bf01ae4c803b64379f84a0 fence-agents-drac5-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 2ef1f4f5ef4c7f1d8244994e3c47c59a6aff15b88dd1bed18615bddeaeb2b687 fence-agents-eaton-snmp-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 7685821cb9c25f19604080876dcdec18a4508233e699dafbc82b0b5e0f829d01 fence-agents-emerson-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 4b521113032e5a51ce6581e8f98e4cce884d5e2c847644bdbbbbc5e06fa362dd fence-agents-eps-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 7c5d9b5bbbed64a85314e4c4863d8406ba14276d0a1aacbd282c422592f565f1 fence-agents-heuristics-ping-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 4bd6dc53e53ac80cd645333f8538f0a6b6f1e6528ac80e35e717a4375db9bbe4 fence-agents-hpblade-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 1c0aba2f2799ee04053f5e16003d4755a91e3f47ef369f7a2bc17f79479a9c23 fence-agents-ibm-powervs-4.2.1-129.el8_10.25.noarch.rpm SHA-256: b0f2f5aaf7fd3c5c7befeddc1272311548b5e0dedebf03f36af0ebebac3a6250 fence-agents-ibm-vpc-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 718d23846504f5d3d5da640dde5b9efdaad776af295fa29f53ffe9fa9a50f77c fence-agents-ibmblade-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 0f2f248575d2411bc2c9bd5069546447baea6b31fc7917e00aa66e3ca95f55d4 fence-agents-ifmib-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 7110a3d7d58df6193d7fa27727150ec26ba8061b5c9933ee8839007b82c717c9 fence-agents-ilo-moonshot-4.2.1-129.el8_10.25.noarch.rpm SHA-256: ae51d795b020b42b4ec568b7da92b1bcb645135ed49d4c04bb77f6c8d8a80c47 fence-agents-ilo-mp-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 2ca3866bf4c9335ea8018b3d97fdbf51a7929cf6153510c27147c7c514bba11c fence-agents-ilo-ssh-4.2.1-129.el8_10.25.noarch.rpm SHA-256: e879c61920935f48cf31f7e202555527a6f24353fdc7cb011689dc1ec1edd30c fence-agents-ilo2-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 064326ece67c87692c975d08a5af2069c9068a94a7574a328ae6be939aaf6867 fence-agents-intelmodular-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 710e162296099768fd9d40fc4dd27e072813642710419b189afae3731f70e2ba fence-agents-ipdu-4.2.1-129.el8_10.25.noarch.rpm SHA-256: d91b860292bcd02f1701db111ed2257871e2730b6f4615d9353c908435f8222a fence-agents-ipmilan-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 252321896cd1d9e5e9dbcc01ae5162f567492a9bd65e4df7640d7fb80b5233fa fence-agents-kdump-4.2.1-129.el8_10.25.x86_64.rpm SHA-256: dff8c10352cf78b8a471d28d6cb649387d0067327af0a37f788e543fe9220b5c fence-agents-kdump-debuginfo-4.2.1-129.el8_10.25.x86_64.rpm SHA-256: a45d710cd4c6902f5ee6468d25edbe7b9164fc6c98760f85328d36ce8fc3a458 fence-agents-kubevirt-4.2.1-129.el8_10.25.x86_64.rpm SHA-256: ce870c98f34b8866df94dad5436905ecf33dc1b4b3a6108915a07724caf0d531 fence-agents-kubevirt-debuginfo-4.2.1-129.el8_10.25.x86_64.rpm SHA-256: b8fc5e6bdeeabaff4d91d5a91e7ccd5da322c898911f3cb88f82503d7a6a30d9 fence-agents-lpar-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 6aa3252d6ec46be2cd31e1dab3513c395c7f98940a5cb40b57c46896514928e4 fence-agents-mpath-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 012380c31fbe26cf6d8ebdc95fcee38fc9083f99707d8c1dab23d26f81ed2629 fence-agents-nutanix-ahv-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 9ed3c02e321a2960177f57b48ac3ec1bbd5f39cae4fbca93a194aba9b51dadc2 fence-agents-redfish-4.2.1-129.el8_10.25.x86_64.rpm SHA-256: 77fd586c71c7756587a9a5fd9f7ee4fec47faa28beb0c782007038533c2555ac fence-agents-rhevm-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 97cf4e21235431984d486ee04785f4cec0c55b04f385053d8eef651235e73a1a fence-agents-rsa-4.2.1-129.el8_10.25.noarch.rpm SHA-256: c7047da8fa18884167e633c10651ca819b4eada753eba5005b2a526cf70cae9b fence-agents-rsb-4.2.1-129.el8_10.25.noarch.rpm SHA-256: d5e0a26264efa4d627d8b0bba32b882241d9a4f245916291cc81b66c536be71e fence-agents-sbd-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 326fa57abce1aeaa2bf182da24807afc70e798e959d46540c8c34fd8c65fab4f fence-agents-scsi-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 6fae376822873b5d9a50bed04bc250dd68e6737c6b63043c6acfd171d391f336 fence-agents-virsh-4.2.1-129.el8_10.25.noarch.rpm SHA-256: fb7bdffd6c050ac9f74950c005e35d29048b4c9af59d6dc5e25e34836f005f80 fence-agents-vmware-rest-4.2.1-129.el8_10.25.noarch.rpm SHA-256: 3f8be6c70b1d88d58d8aed38dddc24efb469799cdee1e854b727d402bd234bfd fence-agents-vmware-soap-4.2.1-129.el8_10.25.noarch.rpm SHA-256: c6c71bb51271717dc671d3473ea02f1791cfddd6a37a8ee4bf3983a78720541b fence-agents-wti-