RHSA-2026:90332 - Security Advisory

Topic

An update for golang-github-openstack-k8s-operators-os-diff is now
available for Red Hat OpenStack Services on OpenShift 18.0 (Antelope).

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Security Fix(es):

• golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate

certificates (CVE-2026-111943)

• golang: golang crypto/x509: Denial of Service via excessive processing of

DNS SAN entries (CVE-2026-27145)

• golang: Go encoding/asn1: Denial of Service via excessive recursion in

Unmarshal (CVE-2026-33818)

• golang: Golang MIME: Denial of Service via maliciously-crafted MIME

header (CVE-2026-42504)

• golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial

of Service (CVE-2026-56853)

• golang: Go html/template: Cross-Site Scripting via pathological input

(CVE-2026-56858)

• golang: golang net/url: Denial of Service from quadratic complexity in

path resolution (CVE-2026-56860)

• golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate

messages (CVE-2026-56862)

• golang: golang: Denial of Service via crafted HTTP Range headers

(CVE-2026-78667)

• net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of

Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)

• golang: crypto/tls: Denial of Service via multiple ECH outer extension

references (CVE-2026-97031)

• golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, see “Updating your environment to the latest maintenance release” at
https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/updating_your_environment_to_the_latest_maintenance_release/index

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat OpenStack Services on OpenShift 18.0 x86_64

Fixes

• BZ - 2484204 - CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
• BZ - 2484207 - CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
• BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
• BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
• BZ - 2515827 - CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
• BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
• BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
• BZ - 2548334 - CVE-2026-78667 net/http: golang: golang: Denial of Service via crafted HTTP Range headers
• BZ - 2548336 - CVE-2026-97031 crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references
• BZ - 2548341 - CVE-2026-94440 net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing
• BZ - 2548344 - CVE-2026-78669 net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
• BZ - 2556068 - CVE-2026-111943 crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

CVEs

• CVE-2026-27145
• CVE-2026-33818
• CVE-2026-42504
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56860
• CVE-2026-56862
• CVE-2026-78667
• CVE-2026-78669
• CVE-2026-94440
• CVE-2026-97031
• CVE-2026-111943

References

• https://access.redhat.com/security/updates/classification/#important