RHSA-2026:90329 - Security Advisory

Topic

An update for etcd, collectd-sensubility and collectd-libpod-stats is now
available for Red Hat OpenStack Platform 17.1 (Wallaby) for Red Hat Enterprise Linux (RHEL) 9.2.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.

Security Fix(es):

• golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate

certificates (CVE-2026-111943)

• net/url: Memory exhaustion in query parameter parsing in net/url

(CVE-2025-61726)

• Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
• golang: golang crypto/x509: Denial of Service via excessive processing of

DNS SAN entries (CVE-2026-27145)

• crypto/tls: golang: Go: Denial of Service vulnerability in certificate

chain building (CVE-2026-32280)

• golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update

messages (CVE-2026-32283)

• golang: Go net package: Denial of Service via long CNAME response in

LookupCNAME (CVE-2026-33811)

• golang: Go encoding/asn1: Denial of Service via excessive recursion in

Unmarshal (CVE-2026-33818)

• golang: net/http: golang.org/x/net/idna: Privilege escalation via

incorrect Punycode label processing (CVE-2026-39821)

• golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial

of Service (CVE-2026-56853)

• golang: Go html/template: Cross-Site Scripting via pathological input

(CVE-2026-56858)

• golang: golang net/url: Denial of Service from quadratic complexity in

path resolution (CVE-2026-56860)

• golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate

messages (CVE-2026-56862)

• etcd: Denial of Service via unbounded TLS handshake goroutines

(CVE-2026-73500)

• net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of

Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack 17.1 for RHEL 9 x86_64

Fixes

• BZ - 2434432 - CVE-2025-61726 golang: net/url: Memory exhaustion in query parameter parsing in net/url
• BZ - 2445356 - CVE-2026-25679 net/url: Incorrect parsing of IPv6 host literals in net/url
• BZ - 2456338 - CVE-2026-32283 crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
• BZ - 2456339 - CVE-2026-32280 crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
• BZ - 2467822 - CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
• BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
• BZ - 2484207 - CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
• BZ - 2515007 - CVE-2026-73500 etcd: etcd: Denial of Service via unbounded TLS handshake goroutines
• BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
• BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
• BZ - 2515827 - CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
• BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
• BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
• BZ - 2548344 - CVE-2026-78669 net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
• BZ - 2556068 - CVE-2026-111943 crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

CVEs

• CVE-2025-61726
• CVE-2026-25679
• CVE-2026-27145
• CVE-2026-32280
• CVE-2026-32283
• CVE-2026-33811
• CVE-2026-33818
• CVE-2026-39821
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56860
• CVE-2026-56862
• CVE-2026-73500
• CVE-2026-78669
• CVE-2026-111943

References

• https://access.redhat.com/security/updates/classification/#important