RHSA-2026:36796

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Memory-safety vulnerability in github.com/jackc/pgx/v5.

gRPC-Go is the Go language implementation of gRPC.

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

spdystream is a Go library for multiplexing streams over SPDY connections.

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint.

Prometheus is an open-source monitoring system and time series database.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applie…

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Prometheus is an open-source monitoring system and time series database.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.