RHSA-2026:36648

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it.

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

A flaw was found in the OpenShift Pipelines operator.

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.