Red Hat Security Advisory

RHSA-2026:17121

Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.8.6

Released 2026-05-13 · Red Hat rating Important · View on Red Hat →

Fixed in

multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/assisted-service-8-rhel8

Fixes 3 records

TI-2026-24814 CVE-2026-32285 · GHSA-6g7g-w4f8-9c9x

Denial of service in github.com/buger/jsonparser

HIGH 72

The Delete function fails to properly validate offsets when processing malformed JSON input.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00779 Published 2026-03-26 Partial fix · 1.1.2 CWE-129

TI-2026-27599 CVE-2026-35469 · GHSA-pc3f-x583-g7j2

SpdyStream: DOS on CRI

MEDIUM 45

spdystream is a Go library for multiplexing streams over SPDY connections.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00656 Published 2026-04-16 Partial fix · 0.5.1 CWE-770

TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248