RHSA-2026:90330 - Security Advisory

Topic

An update for etcd, collectd-sensubility and collectd-libpod-stats is now
available for Red Hat OpenStack Platform 16.2 (Train).

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.

Security Fix(es):

• golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate

certificates (CVE-2026-111943)

• golang: Go encoding/asn1: Denial of Service via excessive recursion in

Unmarshal (CVE-2026-33818)

• golang.org/x/text: Denial of Service via invalid UTF-8 input

(CVE-2026-56852)

• golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial

of Service (CVE-2026-56853)

• golang: Go html/template: Cross-Site Scripting via pathological input

(CVE-2026-56858)

• golang: golang net/url: Denial of Service from quadratic complexity in

path resolution (CVE-2026-56860)

• golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate

messages (CVE-2026-56862)

• etcd: Denial of Service via unbounded TLS handshake goroutines

(CVE-2026-73500)

• net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of

Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack for IBM Power 16.2 ppc64le
• Red Hat OpenStack 16.2 x86_64

Fixes

• BZ - 2504233 - CVE-2026-56852 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
• BZ - 2515007 - CVE-2026-73500 etcd: etcd: Denial of Service via unbounded TLS handshake goroutines
• BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
• BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
• BZ - 2515827 - CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
• BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
• BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
• BZ - 2548344 - CVE-2026-78669 net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
• BZ - 2556068 - CVE-2026-111943 crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

CVEs

• CVE-2026-33818
• CVE-2026-56852
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56860
• CVE-2026-56862
• CVE-2026-73500
• CVE-2026-78669
• CVE-2026-111943

References

• https://access.redhat.com/security/updates/classification/#important