RHSA-2026:68335 - Security Advisory

Topic

Red Hat Edge Manager Version 1.2.1 Security Update

Description

Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused
management of edge devices and applications. It supports image-mode RHEL and
container workloads that run on Podman/Docker or Kubernetes.

RHEM is now available as a standalone feature, providing greater flexibility for
edge deployments. In addition to the standalone version, RHEM continues to be
offered as a plugin for the following platforms:

Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge
devices.
Red Hat Ansible Automation Platform (AAP): Integrates edge management with
Ansible automation.

This integration enables organizations to optimize the management and
orchestration of their fleets of edge devices; whether its thousands of
dispersed retail point-of-sale systems or industrial machinery on remote factory
floors.

Value for customers and partners:

• This solution not only helps customers manage thousands of devices but helps

scale operations.

• To manage large-scale deployments, customers need to be able to integrate with

their existing management systems, support remote configuration and over-the-air
updates, and collect telemetry data for advanced analytics.

• Red Hat Edge Manager offers a simple and security-focused lifecycle

management, from onboarding to decommissioning of edge devices.

This complete end-to-end solution empowers organizations to gain the most value
from the fleets of devices that generate data, all from a centralized location.

Security Fixes:

• flightctl: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
• flightctl: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
• flightctl: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
• flightctl: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)
• flightctl: Arc: Information disclosure and Denial of Service via unauthenticated debug endpoints (CVE-2026-48050)
• flightctl: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)
• flightctl: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
• flightctl: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
• flightctl: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
• flightctl: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
• flightctl: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
• flightctl: go-git: Arbitrary file read/write via symbolic link resolution (CVE-2026-71556)

Solution

See the following documentation for details on how to enable Red Hat Edge
Manager and more:
https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2

Affected Products

• Red Hat Edge Manager 1.2 for RHEL 10 x86_64
• Red Hat Edge Manager 1.2 for RHEL 10 s390x
• Red Hat Edge Manager 1.2 for RHEL 10 ppc64le
• Red Hat Edge Manager 1.2 for RHEL 10 aarch64
• Red Hat Edge Manager 1.2 for RHEL 9 x86_64
• Red Hat Edge Manager 1.2 for RHEL 9 s390x
• Red Hat Edge Manager 1.2 for RHEL 9 ppc64le
• Red Hat Edge Manager 1.2 for RHEL 9 aarch64

Fixes

• BZ - 2483894 - CVE-2026-44740 github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation
• BZ - 2484207 - CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
• BZ - 2484830 - CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers
• BZ - 2504233 - CVE-2026-56852 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
• BZ - 2512562 - CVE-2026-71556 github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution
• BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
• BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
• BZ - 2515827 - CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
• BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
• BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
• BZ - 2515840 - CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

CVEs

• CVE-2026-27145
• CVE-2026-33818
• CVE-2026-41178
• CVE-2026-44740
• CVE-2026-48050
• CVE-2026-56852
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56859
• CVE-2026-56860
• CVE-2026-56862
• CVE-2026-71556

References

• https://access.redhat.com/security/updates/classification/#important