Red Hat Security Advisory

RHSA-2026:19126

yggdrasil security update

Released 2026-05-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) yggdrasil-0.4.9-4.el10_2
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) yggdrasil-devel-0.4.9-4.el10_2

Fixes 2 records

TI-2026-24812 CVE-2026-32283 · GHSA-jrg3-gfjw-hm96

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

MEDIUM 40

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00632 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-770

TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8

Incorrect parsing of IPv6 host literals in net/url

MEDIUM 40

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00827 Published 2026-03-06 Partial fix · 1.25.8, 1.26.1 CWE-425