Red Hat Product Errata RHSA-2026:54634 - Security Advisory Issued: 2026-08-13 Updated: 2026-08-13 RHSA-2026:54634 - Security Advisory Overview Updated Packages Synopsis Important: webkit2gtk3 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-39872) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43663) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43676) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43699) webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43701) webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43705) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43707) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43712) webkitgtk: webkitgtk: Visiting a website may leak sensitive data (CVE-2026-43713) webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43715) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43716) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43720) webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data (CVE-2026-43721) webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43725) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43726) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43727) webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43731) webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information (CVE-2026-43732) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43734) webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory (CVE-2026-43740) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43742) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Fixes BZ - 2280382 - CVE-2024-4367 Mozilla: Arbitrary JavaScript execution in PDF.js BZ - 2500519 - CVE-2026-39872 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500520 - CVE-2026-43663 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500521 - CVE-2026-43676 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500522 - CVE-2026-43699 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500523 - CVE-2026-43701 webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox BZ - 2500524 - CVE-2026-43705 webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption BZ - 2500525 - CVE-2026-43707 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500526 - CVE-2026-43712 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500527 - CVE-2026-43713 webkitgtk: webkitgtk: Visiting a website may leak sensitive data BZ - 2500528 - CVE-2026-43715 webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption BZ - 2500529 - CVE-2026-43716 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500530 - CVE-2026-43720 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500531 - CVE-2026-43721 webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data BZ - 2500532 - CVE-2026-43725 webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox BZ - 2500533 - CVE-2026-43726 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500534 - CVE-2026-43727 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500535 - CVE-2026-43731 webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption BZ - 2500536 - CVE-2026-43732 webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information BZ - 2500537 - CVE-2026-43734 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500538 - CVE-2026-43740 webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory BZ - 2500539 - CVE-2026-43742 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500540 - CVE-2026-43745 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVEs CVE-2024-4367 CVE-2026-39872 CVE-2026-43663 CVE-2026-43676 CVE-2026-43699 CVE-2026-43701 CVE-2026-43705 CVE-2026-43707 CVE-2026-43712 CVE-2026-43713 CVE-2026-43715 CVE-2026-43716 CVE-2026-43720 CVE-2026-43721 CVE-2026-43725 CVE-2026-43726 CVE-2026-43727 CVE-2026-43731 CVE-2026-43732 CVE-2026-43734 CVE-2026-43740 CVE-2026-43742 CVE-2026-43745 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.4 SRPM webkit2gtk3-2.52.5-1.el9_4.src.rpm SHA-256: 43c9580289ce7cf828cadd36d34c82a68ba3c7f2b73c41cb77e35946fe5b2ea6 x86_64 webkit2gtk3-2.52.5-1.el9_4.i686.rpm SHA-256: cdb2a9d25c94b03360a4b8d40252a66f91757ac449f03c9eff854f005f4d1fb5 webkit2gtk3-2.52.5-1.el9_4.x86_64.rpm SHA-256: 0078f12156c6ce49395f6a363369449be1b856739eac8aabaf17cc0909e67081 webkit2gtk3-debuginfo-2.52.5-1.el9_4.i686.rpm SHA-256: 9c06d808f7dc9c8a97544d0db052a7d9412aed78f93041d149106d885c324dfe webkit2gtk3-debuginfo-2.52.5-1.el9_4.x86_64.rpm SHA-256: 012438a0cbb27a35b36560b539c2a9c150cddd3b26e9dce51e3b96f8f16214ba webkit2gtk3-debugsource-2.52.5-1.el9_4.i686.rpm SHA-256: fa3edb3b16fb0d16aaffb4cfe9c08c9bc27c5a586c475aa3d54f72b1485ecb61 webkit2gtk3-debugsource-2.52.5-1.el9_4.x86_64.rpm SHA-256: cf4e536a84b024c01c5f8f1f5c1152b3c9978482d0918a36a77645f033cdbaa5 webkit2gtk3-devel-2.52.5-1.el9_4.i686.rpm SHA-256: 68a8f8d8048e2aab8d7829f4c43d7c6fb3b9a652b3913ad558c8c004e5217f48 webkit2gtk3-devel-2.52.5-1.el9_4.x86_64.rpm SHA-256: 2d3b95bd17d8943b89c34f1b18233ac991ede300e469f3ddeda38d1ce2e65322 webkit2gtk3-devel-debuginfo-2.52.5-1.el9_4.i686.rpm SHA-256: 88ad0c1721fa96ef32509a8975ce149983b183ef285bb41c0b8878a995ceac7f webkit2gtk3-devel-debuginfo-2.52.5-1.el9_4.x86_64.rpm SHA-256: 0d51e86557d036ac75f13c4a43b8025b579b8ad88565ef9b0e422defd9962b13 webkit2gtk3-jsc-2.52.5-1.el9_4.i686.rpm SHA-256: 0b8a127e147688fa476d8a7837e38198587576a19529b6d105067d066f5bbeb9 webkit2gtk3-jsc-2.52.5-1.el9_4.x86_64.rpm SHA-256: 78a2acd1dc63912f725137389d4b2320309d9a8a8e79d22d892d475dc22a78be webkit2gtk3-jsc-debuginfo-2.52.5-1.el9_4.i686.rpm SHA-256: 37e83e6ef04e8cf8efc58941686032fbff70bc40ce79c80d9e0167885b95c694 webkit2gtk3-jsc-debuginfo-2.52.5-1.el9_4.x86_64.rpm SHA-256: 6e9e2e1e9f91d3fda866d2ea722bd72f9c943c18fb51fa1854b23575ed15e224 webkit2gtk3-jsc-devel-2.52.5-1.el9_4.i686.rpm SHA-256: b131bce172af74fb82d357f21a6956a7ca2408a752c48cc5af04285d9b5c2ebc webkit2gtk3-jsc-devel-2.52.5-1.el9_4.x86_64.rpm SHA-256: 456ffea36a1d83bc542cbd20be2b0d43859422affa0e9b60c7eecf2678a37ffc webkit2gtk3-jsc-devel-debuginfo-2.52.5-1.el9_4.i686.rpm SHA-256: ac61379c61525159500c848629dce0990e09bb2c39ab542b47556dc5dec602b0 webkit2gtk3-jsc-devel-debuginfo-2.52.5-1.el9_4.x86_64.rpm SHA-256: 3c612b31b676053445a61d54b204ac360732a3d8803216cd83f3191d03de63dd Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 SRPM webkit2gtk3-2.52.5-1.el9_4.src.rpm SHA-256: 43c9580289ce7cf828cadd36d34c82a68ba3c7f2b73c41cb77e35946fe5b2ea6