RHSA-2026:66401 - Security Advisory

Topic

Updated packages that resolve various issues are now available for Red Hat OpenStack Platform 17.1 (Wallaby) for Red Hat Enterprise Linux (RHEL) 9.2.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.

Security Fix(es):

• Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling

in OpenStack Nova (CVE-2026-24708)

• net/url: Memory exhaustion in query parameter parsing in net/url

(CVE-2025-61726)

• Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
• crypto/tls: golang: Go: Denial of Service vulnerability in certificate

chain building (CVE-2026-32280)

• golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update

messages (CVE-2026-32283)

• crypto/tls: Incorrect certificate validation during TLS session

resumption (CVE-2025-68121)

• internal/syscall/unix: Root.Chmod can follow symlinks out of the root

(CVE-2026-32282)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack 17.1 for RHEL 9 x86_64
• Red Hat OpenStack Director Deployment Tools 17.1 for RHEL 9 x86_64
• Red Hat Enterprise Linux for x86_64 9 x86_64

Fixes

• BZ - 2430312 - CVE-2026-24708 openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova
• BZ - 2434432 - CVE-2025-61726 golang: net/url: Memory exhaustion in query parameter parsing in net/url
• BZ - 2437111 - CVE-2025-68121 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
• BZ - 2445356 - CVE-2026-25679 net/url: Incorrect parsing of IPv6 host literals in net/url
• BZ - 2456336 - CVE-2026-32282 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
• BZ - 2456338 - CVE-2026-32283 crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
• BZ - 2456339 - CVE-2026-32280 crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
• OSPRH-25386 - Neutron SR-IOV agent restart interrupts connectivity for ports with propagate_uplink_status flag
• OSPRH-25998 - Impossible to extend FC-based volumes on loaded computes because of "multipathd resize map" exit codes
• OSPRH-31915 - HPE: Fix handling of QOS for Alletra MP
• OSPRH-26003 - TripleO may bring down pacemaker in InstanceHA overclouds via suboptimal puppet-pacemaker calls
• OSPRH-19640 - [17.1] 'nova-manage image_property set' does not update request_specs
• OSPRH-23919 - Add os_params in rabbitmq_bundle
• OSPRH-25720 - [rhos17.1] Cinder database purge fails due to foreign key constraint errors due to bad timestamp handling
• OSPRH-29196 - [FFU 16.2-17.1.13] Overcloud upgrade is failing with "Unexpected templating type error occurred on ({{ (static_brick_locks + dynamic_brick_locks)""

CVEs

• CVE-2025-61726
• CVE-2025-68121
• CVE-2026-24708
• CVE-2026-25679
• CVE-2026-32280
• CVE-2026-32282
• CVE-2026-32283

References

• https://access.redhat.com/security/updates/classification/#important