Red Hat Security Advisory

RHSA-2026:11217

RHACS 4.8.11 security and bug fix update

Released 2026-04-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8 +2

Fixes 8 records

TI-2026-24815 CVE-2026-32286 · GHSA-jqcq-xjh3-6g23

Denial of service in github.com/jackc/pgproto3/v2

HIGH 72

The DataRow.Decode function fails to properly validate field lengths.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00675 Published 2026-03-26 Partial fix CWE-129

TI-2026-26188 CVE-2026-33816 · GHSA-9jj7-4m8r-rfcm

CVE-2026-33816 in github.com/jackc/pgx

MEDIUM 50

Memory-safety vulnerability in github.com/jackc/pgx/v5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00583 Published 2026-04-07 Partial fix · 5.9.0 CWE-20

TI-2026-26187 CVE-2026-33815 · GHSA-xgrm-4fwx-7qm8

CVE-2026-33815 in github.com/jackc/pgx

MEDIUM 50

Memory-safety vulnerability in github.com/jackc/pgx/v5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00629 Published 2026-04-07 Partial fix · 5.9.0

TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3

gRPC-Go has an authorization bypass via missing leading slash in :path

MEDIUM 49

gRPC-Go is the Go language implementation of gRPC.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01619 Published 2026-03-20 Partial fix · 1.79.3 CWE-285

TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

MEDIUM 46

Immutable.js provides many Persistent Immutable data structures.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0099 Published 2026-03-06 Partial fix · 3.8.3, 4.3.7 +2 CWE-1321

TI-2026-27599 CVE-2026-35469 · GHSA-pc3f-x583-g7j2

SpdyStream: DOS on CRI

MEDIUM 45

spdystream is a Go library for multiplexing streams over SPDY connections.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00656 Published 2026-04-16 Partial fix · 0.5.1 CWE-770

TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248

TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8

Incorrect parsing of IPv6 host literals in net/url

MEDIUM 40

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00827 Published 2026-03-06 Partial fix · 1.25.8, 1.26.1 CWE-425