Red Hat Product Errata RHSA-2026:95206 - Security Advisory
Issued:
2026-11-04
Updated:
2026-11-04

RHSA-2026:95206 - Security Advisory

Synopsis

Updated Red Hat OpenStack Platform 16.2 director Operator container images

Type/Severity

Security Advisory: Important

Topic

Updated container images are now available for director Operator for Red Hat OpenStack Platform 16.2 (Train) for RHEL 8.4.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.

The Red Hat OpenStack Platform (RHOSP) director Operator adds the ability to install and run a RHOSP cloud within OpenShift Container Platform (OCP).

Security Fixes:

  • golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
  • golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
  • golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  • golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
  • golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  • golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
  • golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
  • golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
  • golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
  • golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  • golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Solution

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io or registry.access.redhat.com using the 'podman pull' command.

For more information about the images, search the image name in the Red Hat Ecosystem Catalog.

Affected Products

  • Red Hat OpenStack

Fixes

(none)

amd64

registry.redhat.io/rhosp-rhel8/osp-director-agent@sha256:71db0458b0db758d312e2d2cb59013bb0e79fa0c7ae06c7b0e386ae0db82d220
registry.redhat.io/rhosp-rhel8/osp-director-downloader@sha256:79c9d15266c7e500af924b8aed0cf6d53eae1ae9f516d05548031249001e5b65
registry.redhat.io/rhosp-rhel8/osp-director-operator-bundle@sha256:0adbe2c93819ef7c63bbf02b6acd6a09936dae526dff125f706cce87bfff804c
registry.redhat.io/rhosp-rhel8/osp-director-operator@sha256:8ccad88a3718868dd2f75e7bc421db851129ea90e9e612e04d204daecac431cb

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.